Stacks

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Any attacks that the reporter has already exploited themselves, leading to real-world damage.
• Any attacks requiring access to leaked keys or credentials.
• Any attacks requiring access to a privileged address, including but not limited to any governance or strategist addresses.
• Any attacks on 3rd party services, including but not limited to AWS or Datadog.
• Any sub-optimal default configuration changes.

The following activities and findings are explicitly out of scope of this bug bounty program:

• Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof.
• Any reporting of findings that are already public or known to us, including but not limited to: open Github PRs and issues; previous findings reported by other researchers; findings discovered during currently-active third-party security assessments; and duplicated results of concluded assessments as posted here: https://stacks.org/audits. Novel methods of attack leading to an already-documented impact are allowed.
• Any testing of third-party components.
  • If it’s not listed as in-scope, it’s safe to assume you shouldn’t be testing or relying on it.
  • If you disagree, feel free to explain why in your submission but DO NOT continue testing with our explicit written approval.
• (If applicable to funds) Any actual theft or freeze of funds.
• Any findings requiring access to or the cooperation of a Bitcoin miner.
• Any theoretical attacks without substantial evidence and supporting documentation.

The following activities will make you immediately ineligible for a reward, regardless of your report’s validity:

• Any failure to provide any information requested in the above reporting template.
• Any failure to use the given public GPG key to encrypt sensitive information.
• Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.
  • This also includes repeatedly asking for multiple status updates - we promise we have eyes on your report.
• Any automated scanner findings or fuzz test results without an associated functional proof-of-concept.
• Any testing on mainnet or public testnet beyond the absolute minimum required to prove that your finding exists on them.
• Any active exploitation of a reported vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.
  • You must not attack any other users under any circumstances. Test on your own addresses or contracts.
• Any public disclosure of a reported issue, including via CVE number assignment.
• Any failure to abide by any rules, requirements, or obligations as detailed above.

The following activities are prohibited by this bug bounty program:

• Any testing with mainnet or public testnet contracts.
  • all testing should be done on private testnets.
• Any testing with pricing oracles or third party smart contracts.
• Any attempting of phishing or other social engineering attacks against any Stacks ecosystem member.
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks).
• Any denial-of-service attacks.
• Any automated testing of services on mainnet that generates significant amounts of traffic.
• Any public disclosure of an unpatched vulnerability in an embargoed bounty.