Bug Bounty Program -

Smart Contracts and Blockchain

Incorrect data supplied by third-party oracles
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Centralization Risks

Websites and Apps

Theoretical vulnerabilities without any proof or demonstration
Content spoofing / Text injection issues
Self-XSS
Captcha bypass using OCR
CSRF with no security impact (logout CSRF, change language, etc.)
Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
Server-side information disclosure such as IPs, server names, and most stack traces
Vulnerabilities used to enumerate or confirm the existence of users or tenants
Vulnerabilities requiring unlikely user actions
URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
Lack of SSL/TLS best practices
DDoS vulnerabilities
Attacks requiring privileged access from within the organization
Feature requests
Best practices

The following activities are prohibited by this bug bounty program:

Any testing with mainnet or public test net contracts; all testing should be done on private testnets
Any testing with pricing oracles or third-party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third-party systems and applications (e.g., browser extensions) as well as websites (e.g., SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty