Open tomsanch opened 3 years ago
Issue Status: 1. Open 2. Started 3. Submitted 4. Done
This issue now has a funding of 30000.0 DAI (30000.0 USD @ $1.0/DAI) attached to it.
Issue Status: 1. Open 2. Started 3. Submitted 4. Done
Work has been started.
These users each claimed they can complete the work by 2 months, 1 week ago. Please review their action plans below:
1) bocryp has started work.
my bug bounty 2) ruslimjr has started work.
Tentang agama Islam. 3) x00x00 has started work.
Web application pentesting, network pentesting 4) ali2210 has started work.
Find Bugs in Decentralized Oracle Network (DON), find attacks where bad actors temper the system or take advantage. Prove worthiness of content. 5) cjsaveas has started work.
I'd like to give it a try, hope I can finish this job. 6) korobeiniki17 has started work.
Total Number of Vulnerabilities Detected: 12 in witnet host, but I believe there are many more vulnerabilities that cloudflare is blocking to run, anyway if you want a complete scan of your platform I will need you to disable cloudflare or create a clone of the website for me to do penetration tests.
Learn more on the Gitcoin Issue Details page.
Issue Status: 1. Open 2. Started 3. Submitted 4. Done
Work for 30000.0 DAI (30000.0 USD @ $1.0/DAI) has been submitted by:
@korobeiniki17 Hi, thanks for your effort. I'm sorry to inform you that your submission is not eligible for a reward under the terms of this bounty program, which explicitly excludr any bug found on the Witnet websites witnet.io and all the third-level websites on those domains.
Witnet Bug Bounty Program
Submit before 7th October 2020 and your reward may be applicable for a multiplier, as specified in the Reward Criteria below.
The Witnet community appreciates the assistance of the Gitcoin community in exposing and fixing vulnerabilities that will ensure the Witnet protocol is robust leading up to (and in the months following) the launch of Mainnet in October 2020. The Bounty Program was announced in July 2020 as part of the Witnet Testnet Incentive Program, and we are now happy to open it up to the Gitcoin community.
For full terms and conditions on the Program, please click here.
About Witnet
Witnet is a decentralized oracle network (DON) that connects smart contracts to the real, off-chain world. Broadly speaking, it allows any piece of software to retrieve information published at any web address at any point in time, with complete and verifiable proof of the information's integrity, without blindly trusting any third party.
The Witnet protocol achieves this by permitting a network of computers to act as a "decentralized oracle" that retrieves, attests and delivers information to smart contracts, with no single point of trust.
Response Target
The Witnet Foundation will try to meet the following SLAs when any reported bug is made by a member of the security community:
We’ll do our best to ensure all communication is clear and concise throughout the process.
Rewards and Judging Process
Submit before 7th October 2020 and your vulnerability may be applicable for a reward multiplier, as specified below.
Generally speaking, any bug that poses a significant vulnerability, either to the soundness of protocol and protocol/implementation compliance to network security, to classical client security as well as security of cryptographic primitives, could be eligible for a reward.
The Witnet Foundation will take into account:
What’s Eligible for Reward?
Uncovering a bug that poses a significant vulnerability to:
Attacking the Witnet network by:
Creating a data request that:
Running a Witnet<> Ethereum bridge node that:
What’s Not Eligible for Reward?
These bugs and attacks will NOT be eligible for any reward:
Please note: it’s entirely at the Witnet Foundation’s discretion to decide whether a bug or an attack is significant enough to be eligible for reward.
Resources
General info:
Community info:
Technical info:
witnet-rust GitHub repo* → https://github.com/witnet/witnet-rust
Witnet Truffle Box* → https://bit.ly/2OT1XhQ
Repo with price feed ready to compile and migrate → https://bit.ly/2SI1Uqt
/ * These are priorities for this program. Bugs or vulnerabilities which threaten the security of funds for the node operators or data requestors will be rewarded with the most generous rewards.
Disclosure Policy
By participating in this program, you will:
Submitting a Bug or Vulnerability
Please provide a detailed report with completely replicable steps. Send your report to testnet@witnet.foundation and include the following:
Furthermore:
Submissions must be made before the 12 Jan 2021. Submissions made before October 7 2020 may be applicable for a reward multiplier, as specified above.
A huge thank you from the Witnet community! We look forward to hearing from you.