search

zincwork / contracts

Identity smart contract mesh - developed by Zinc
https://zinc.work
MIT License
55 stars 12 forks source link

Zinc Platform ~ UI Bug Bounty :bug: #25

Open Shippable-ls opened 6 years ago

Shippable-ls commented 6 years ago

Hello UI Bounty Hunters,

Zinc is a work based identity platform, our goal is to open source the interview process. We've developed a recruiting toolkit that helps companies hire and allows individuals to own any information that's collected during the interview process. Workers can build out blockchain based work passports through our referencing tool. Workers can collect "Work proofs" by attending workshops, events, or doing open source work.

We've recently moved to the main Ethereuem network and are opening the platform up for community testing prior to our public launch planned for later in September.

Task: The task is to find functionality bugs in the Zinc application UI: https://zinc.work/. We are looking for unexpected UI behavior or unexpected errors occurring.

Application details: Site: https://zinc.work/ Collect reference instructions: https://medium.com/@zinc_ship/collecting-a-personal-reference-with-zinc-2a9d30e71cd1 Collect a work proof instructions: https://medium.com/@zinc_ship/collecting-a-work-proof-with-zinc-a1b1e35fdbcc

Scope: In app pages on: https://zinc.work/ platform.

Rewards: ~ Critical functionality misbehavior: 0.4 ETH ~ Unexpected functionality misbehavior: 0.1 ETH ~ Unexpected Errors: 0.08 ETH

Requirements: ~ Ability to access a desktop website ~ Metamask usability

Only functionality issues will be paid out not styling. Provide us with at least 5 working days to investigate the issue and revert back to you.

Payouts will be made to the first individuals who report bugs and final discretion of Zinc.

gitcoinbot commented 6 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

This issue now has a funding of 0.001 ETH (0.23 USD @ $229.47/ETH) attached to it.

gitcoinbot commented 6 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

Work has been started.

These users each claimed they can complete the work by 1 month ago. Please review their action plans below:

1) Steampunk1453 has started work.

I'm going to check Zinc Platform for testing possible bugs

Learn more on the Gitcoin Issue Details page.

2) srisankethu has started work.

I will check zinc.work for both UI and functionality bugs.

Learn more on the Gitcoin Issue Details page.

3) jubalharsho has started work.

I have started to test and found some bugs already. I will finish the test in a few days and list all of them. How do you prefer to list them: creating separate issue for each bug or comment list here is just fine?

Learn more on the Gitcoin Issue Details page.

PaulRBerg commented 6 years ago

I found a UX problem which falls under the "Unexpected functionality misbehaviour" category. Steps to reproduce:

  1. Receive a reference request
  2. Write the answers to all the questions there
  3. Close the browser tab or window
  4. Answers are lost

Ideally, the state of the reference would be kept in cookies.

srisankethu commented 6 years ago

On opening https://zinc.work/, I opened the developer tools. Gives Reference error '$' is not defined. I think this would fall under "Unexpected errors". It is a very minor issue though.

srisankethu commented 6 years ago

Just after signing up,

  1. I have entered "Student' in "Job title" and then refreshed the page. It was blank.
  2. I have filled up "Job title" and "Location", for example say, "Student" and "India" Then refreshed the page. They are present.
  3. Then I removed them i.e blank. Now I refreshed the page. This time, it is storing the previously entered value i.e "Student" and "India". 4 . Now I have removed them i.e blank and then entered "Teacher" in "Job title" and refreshed the page. Now it is "Teacher" and "India".

I think this would come under "unexpected functionality misbehaviour". Shouldn't there be "Save Changes" just like the form for "First Name" and "Last Name" in the account.

srisankethu commented 6 years ago

I saved an ethereum address for "First name" and "Last name". It works :( This would come under "unexpected functionality behaviour".

srisankethu commented 6 years ago

I have sent a mock "Reference request". It cost me 10 ZINC tokens. On successful submission, I have received 10 ZINC tokens instead of 5 ZINC tokens as mentioned in the email i.e my token balance is back to 30 ZINC tokens. BTW, am I supposed to get 5 ZINC tokens on successful reference submission(acceptance).

This is a "Critical functionality misbehaviour".

srisankethu commented 6 years ago

In this next mock "Reference request", I sent a "Reference request" to my email address(as a referee) with which I have verified my account. It works :(

While I gave the referee's first name and last name as "Naruto" and "Uzumaki"(I used the same for my previous reference), the referee's name is shown as "Sri Sanketh Uppalapati"(my actual name attached to my gmail account).

This is a "Critical functionality misbehaviour".

srisankethu commented 6 years ago

Same at the above for "Request candidate reference". Sent request to my email address(the same one with which I signed up/verified). Balance back to 30 ZINC.

This is a "Critical functionality misbehaviour".

srisankethu commented 6 years ago

After successful "Request candidate reference". I tried to share it. https://app.zinc.work/candidate/8db731c3443f455d890a57fa665b55e2 gives a server error. Tried using a fresh browser as well as the own in which I am logged in, yields the same result -> server error.

This is a "Critical/Unexpected functionality misbehaviour".

srisankethu commented 6 years ago

@Shippable-ls The "request reference" and "request reference candidate" are buggy and confusing too. Please look into this "critical" issue using the above cases(along with others mentioned). Really like the idea of your project and would love to use it after a perfect mainnet launch.

My eth address is 0x9da0EBd235F1B3aDB59FF83eA038BA6bCfB200a5.

gitcoinbot commented 6 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

Work for 0.001 ETH (0.22 USD @ $219.17/ETH) has been submitted by:

  1. @jubalharsho
  2. @srisankethu

@Shippable-ls please take a look at the submitted work:

jubalharsho commented 6 years ago

I finished the test (with Firefox version 62) and found these new issues:

  1. ENS field can get focus but cannot be edited while creating account 1.1. Enter ENS name on the first form while creating account 1.2. The name is accepted and the second form is displayed 1.3. Click on the ENS field in the second form: it gets focus as though user could edit it, while they cannot

  2. Request reference form not cleared after canceling it 2.1. Fill out the request reference form but do not submit it 2.2. Click cancel button (or click away from it) 2.3. Click request reference button: the form is not cleared displaying all the values before canceling it

  3. No max character number for skills input fields in request reference form 3.1. For many fields there is no max character limit resulting in screens like this:

  4. Copy button does not close the copy dialog 4.1. Pressing the copy button on a copy dialog does not closes it

Also I reproduced #29, #30 and https://github.com/zincwork/contracts/issues/25#issuecomment-419681129 - when providing reference from different mail in new tab, same browser window/session returning the user to the referenced user's profile page and took 20, not just 10 zinc tokens from the latter. I think that is connected with a persistent local storage. However it seems strange/unexpected. Interestingly, old tab showed just 20 tokens left before 30 after refreshing - maybe the live updates are just not supported.

Shippable-ls commented 6 years ago

@PaulRBerg

I found a UX problem which falls under the "Unexpected functionality misbehavior" Ideally, the state of the reference would be kept in cookies.

Thanks for taking a look and giving us your feedback. Agreed, the state of the reference would be kept in cookies. However, intentionally don't ask referees to create an account until after they provide the reference. We do this to reduce the friction for referees and collect as many references as possible. Hence every referee is anonymous until after they submit the reference so sadly there's no user to store cookies against.

Shippable-ls commented 6 years ago

@srisankethu

I think this would come under "unexpected functionality misbehaviour". Shouldn't there be "Save >Changes" just like the form for "First Name" and "Last Name" in the account.

Thanks for taking part in this bounty. You save the title & location field in 2 ways, either by hitting enter or clicking anywhere else on your profile page. This is considered intelligent saving. If you enter text in these fields then refresh or close the browser whilst the cursor is still in the textbox, this will not save. I think this covers your outcomes but correct me if I'm wrong.

Shippable-ls commented 6 years ago

@srisankethu

I saved an ethereum address for "First name" and "Last name". It works :( This would come under "unexpected functionality behaviour".

We allow all characters; letters, numbers, unicode characters. This is intentional not to discriminate against any characters.

Shippable-ls commented 6 years ago

@srisankethu

I have sent a mock "Reference request". It cost me 10 ZINC tokens. On successful submission, I have received 10 ZINC tokens instead of 5 ZINC tokens as mentioned in the email i.e my token balance is back to 30 ZINC tokens. BTW, am I supposed to get 5 ZINC tokens on successful reference submission(acceptance).

This is a "Critical functionality misbehaviour".

The systems will not behave correctly if a reference is requested and provided in the same browser session. We do not think that this is useful to our network. As a worker, you earn 5 ZINC when a reference comes back and as a referee, you earn 5 ZINC for completing a reference. If you play both these roles in the same session then you'll earn the tokens for each role.

Shippable-ls commented 6 years ago

After successful "Request candidate reference". I tried to share it. https://app.zinc.work/candidate/8db731c3443f455d890a57fa665b55e2 gives a server error. Tried using a fresh browser as well as the own in which I am logged in, yields the same result -> server error.

This is a "Critical/Unexpected functionality misbehaviour".

This was bug in the system that has now been fixed. Thanks for flagging, please submit your work.

Shippable-ls commented 6 years ago

I finished the test (with Firefox version 62) and found these new issues:

  1. ENS field can get focus but cannot be edited while creating account

Thanks for taking part. This is intentional behavior. When you first type your ENS name, the system is checking if this name is taken. For instance, you may own this name already and simply be logging in. Once you move to the next page, you cannot edit the ENS subdomain since we're no longer checking if it's taken on this page. If you want to edit the ENS subdomain, you have to move back.

  1. Request reference form not cleared after canceling it

The idea of saving these details is that we think it's likely the worker may have to navigate away from this page to recall some work details. For instance, checking the dates that they worked somewhere.

  1. No max character number for skills input fields in request reference form

This is a valid point and something we will discuss. Thanks for raising it.

  1. Copy button does not close the copy dialog

We would not expect a copy button to close a text box.

Also I reproduced #29, #30 and #25 (comment) - when providing reference from different mail in new tab, same browser window/session returning the user to the referenced user's profile page and took 20, not just 10 zinc tokens from the latter. I think that is connected with a persistent local storage. However it seems strange/unexpected. Interestingly, old tab showed just 20 tokens left before 30 after refreshing - maybe the live updates are just not supported.

srisankethu commented 6 years ago

@srisankethu

I have sent a mock "Reference request". It cost me 10 ZINC tokens. On successful submission, I have received 10 ZINC tokens instead of 5 ZINC tokens as mentioned in the email i.e my token balance is back to 30 ZINC tokens. BTW, am I supposed to get 5 ZINC tokens on successful reference submission(acceptance). This is a "Critical functionality misbehaviour".

The systems will not behave correctly if a reference is requested and provided in the same browser session. We do not think that this is useful to our network. As a worker, you earn 5 ZINC when a reference comes back and as a referee, you earn 5 ZINC for completing a reference. If you play both these roles in the same session then you'll earn the tokens for each role.

Shouldn't that be a problem since I am giving different referee and referer details?

I will submit my work. UPDATE: I have submitted my working adding your comment as PR. @Shippable-ls

jubalharsho commented 6 years ago

Thanks for the comments @Shippable-ls !

I forgot to attach the screenshot for point 3: no chars limit

Also I forgot to write down the last issues I found. Continuing my list:

  1. When there is mismatch in the provided dates from the referrer and referee the exact values are not displayed and the mail looks like: dates
srisankethu commented 6 years ago

@Shippable-ls Its been 2 weeks since the last update. I understand you are busy but just reminding.

frankchen07 commented 6 years ago

@Shippable-ls - Frank from Gitcoin here. Is this issue still open and in progress - it looks like you have submitted work to review from @srisankethu and @jubalharsho!

gitcoinbot commented 6 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

The funding of this issue was increased to 0.701 ETH (143.48 USD @ $204.68/ETH) .

gitcoinbot commented 6 years ago

⚡️ A tip worth 0.40000 ETH (81.87 USD @ $204.68/ETH) has been granted to @srisankethu for this issue from @Shippable-ls. ⚡️

Nice work @srisankethu! To redeem your tip, login to Gitcoin at https://gitcoin.co/explorer and select 'Claim Tip' from dropdown menu in the top right, or check your email for a link to the tip redemption page.

gitcoinbot commented 6 years ago

⚡️ A tip worth 0.20000 ETH (40.94 USD @ $204.68/ETH) has been granted to @jubalharsho for this issue from @Shippable-ls. ⚡️

Nice work @jubalharsho! Your tip has automatically been deposited in the ETH address we have on file.

gitcoinbot commented 6 years ago

⚡️ A tip worth 0.10000 ETH (20.47 USD @ $204.68/ETH) has been granted to @PaulRBerg for this issue from @Shippable-ls. ⚡️

Nice work @PaulRBerg! Your tip has automatically been deposited in the ETH address we have on file.

Shippable-ls commented 6 years ago

Thanks for the reminder Frank. All settled now.

On Wed, Oct 24, 2018 at 10:28 PM Frank notifications@github.com wrote:

@Shippable-ls https://github.com/Shippable-ls - Frank from Gitcoin here. Is this issue still open and in progress - it looks like you have submitted work to review from @srisankethu https://github.com/srisankethu and @jubalharsho https://github.com/jubalharsho!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/zincwork/contracts/issues/25#issuecomment-432834597, or mute the thread https://github.com/notifications/unsubscribe-auth/AWHXL4Oq_gxsypf6mp9ueE7z3ITp7QXRks5uoNtpgaJpZM4WdH1m .

-- /Regards/ Luke Shipley

Join Our Community >>> Zinc https://t.me/zinc_work

This message contains confidential information. It may be legally privileged. If you are not the intended recipient, please notify the sender and delete the message immediately. Zinc Work limited is a company registered in England and Wales. Registered at; Highbridge House, 93-96 Oxford Road, Uxbridge, UB8 1LU and legally represented by Kemp Little.

frankchen07 commented 6 years ago

@Shippable-ls - awesome. Because this is a bug bounty, would you like us to keep it open (and maybe removed the expired status on Gitcoin?)

Shippable-ls commented 6 years ago

Thanks Frank. But we’ll keep it closed for now.

On 26 Oct 2018, at 18:51, Frank notifications@github.com wrote:

@Shippable-ls - awesome. Because this is a bug bounty, would you like us to keep it open (and maybe removed the expired status on Gitcoin?)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.