Threshold Network-logo

Threshold Network

Threshold is the first ever on-chain merge between two existing networks and communities, Keep and NuCypher. The Threshold Network provides a suite of threshold cryptography products that power user sovereignty on the public blockchain. Threshold cryptography distributes sensitive operations across multiple independent entities, like nodes in a network. A successful operation requires a threshold or a minimum number of entities to cooperate.

Arbitrum
ETH
Optimism
Polygon
Solana
Blockchain
Defi
Crosschain Liquidity
Currency
Staking
Synthetic Assets
JavaScript
Solidity
Maximum Bounty
$500,000
Live Since
28 April 2023
Last Updated
27 September 2024
  • PoC required

Rewards

Threshold Network provides rewards in T on Ethereum, denominated in USD.

Rewards by Threat Level

Smart Contract
Critical
USD $10,000 to USD $500,000
High
USD $5,000 to USD $50,000
Medium
USD $1,000 to USD $5,000
Low
USD $1,000
Websites and Applications
Critical
USD $5,000 to USD $10,000
High
USD $1,000 to USD $5,000
Medium
USD $1,000

Please review how rewards are distributed based on the Immunefi Vulnerability Severity Classification System V2.3 This is a simplified 4-level scale system with separate scales for Smart Contracts and Websites/Apps.

Rewards for critical smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 10 000 and a max program cap of USD 500 000

Rewards for high smart contract bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 5 000 and a max cap of USD 50 000

Rewards for medium smart contract vulnerabilities with direct monetary impact are further capped at 100% of the funds at risk. However, there is a minimum reward of USD 1 000 and a max cap of USD 5 000

Rewards for critical web/app bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 5 000.

Rewards for high web/app bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 1 000.

Payouts and Payout Requirements

Payouts are handled by the Threshold DAO team directly and are denominated in USD. However, payouts are made in T. (https://www.coingecko.com/en/coins/threshold-network-token#markets).

The calculation of the net amount rewarded is based on the average price between high and low for the day of the report submission as published on CoinMarketCap.com Historical Data (https://coinmarketcap.com/currencies/threshold/historical-data/) for the T token. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price at the time of the bug report submission is USD 1.75 per token, then the reward will be 2857.142857 units of that token.

Threshold Network commits to honoring payouts according to the terms set out in this program at the time of report submission, and to treat this program as the agreement and source of truth concerning bug reports and responsible disclosures.

For the purposes of determining report validity, this is a Primacy of Rules program.

Learn more about report validity best practices here: Best Practice - Primacy of Impact vs Primacy of Rules.

Threshold Network would like to notify whitehats that payouts concerning high and critical reports may exceed the SLA established by Immunefi. These larger payouts could be delayed by a few hours or days, depending on the amount, to allow our governance process to fund the required payment, which can take up to 14 days. Threshold Network will inform the whitehat whenever this is the case, within the SLA timeframe, to manage expectations and provide clarity.

KYC Requirements:

Threshold Network does not have a Know Your Customer (KYC) requirement for bug bounty payouts.

Responsible Publication

Threshold adheres to category 2. This Policy determines what information whitehats are allowed to make public from their submitted bug reports. For more information about the category selected, please refer to our Responsible Publication page.

Audit Discoveries and Known Issues:

Bug reports covering previously-discovered bugs are not eligible for any reward through the bug bounty program. If a bug report covers a known issue, it may be rejected together with proof of the issue being known before escalation of the bug report via Immunefi.

Previous audits and known issues can be found at:

Program Overview

Threshold is the first ever on-chain merge between two existing networks and communities, Keep and NuCypher. The Threshold Network provides a suite of threshold cryptography products that power user sovereignty on the public blockchain. Threshold cryptography distributes sensitive operations across multiple independent entities, like nodes in a network. A successful operation requires a threshold or a minimum number of entities to cooperate. This simple idea increases security and availability and reduces reliance on trusted parties.Threshold is governed by a DAO whose parts hold separate responsibilities that are embedded in the governance structure. The Threshold DAO has two primary bodies: the Tokenholder DAO (based on the Governor Bravo governance model) and the Elected Council. The goal of this two-pronged structure is to enhance representation while ensuring accountability. Each governance body holds the other accountable, similar to the system of checks and balances found in most constitutional governments.

For more information about Threshold Network, please visit https://threshold.network/

For Whitehats: It is highly recommended that you review the details of this program in full. Although many Bug Bounty programs have standard terms and conditions, each also has their own unique details that are critical to your success.

Prior to submitting a report please review the Immunefi Bug Report Template and Best Practices.

KYC not required

No KYC information is required for payout processing.

Proof of Concept

Proof of concept is always required for all severities.

Responsible Publication

Category 2: Notice Required

Prohibited Activities

Default prohibited activities
  • Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
  • Any testing with pricing oracles or third-party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks that are executed against project assets
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty
  • Any other actions prohibited by the Immunefi Rules

Feasibility Limitations

The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.

Total paid

632.3k

Med. Resolution Time
19 hours
Total Assets in Scope
38