cLabs Celo Bug Bounty Program
Program Status: Active
KYC Required: Yes
Launched: 10 Feb 2024
Expires: Non-expiring
Max Payout: $25,000
GENERAL INFORMATION
cLabs supporting $CELO cryptocurrency in building financial technology to enable prosperity for all.
Assets type:
- Smart Contracts
- Websites and Applications
- Blockchain/DLT
Chains:
Programming language:
- Solidity
- JavaScript
- Rust
- Go
- Python
- Other
Product types:
- DeFi
- Technology and Infrastructure
- Scaling solutions
- GameFi
- Zero Knowledge Proofs
- Website
- Other
Project categories:
- Asset Management
- Cross-chain
- Currency
- L1
- L2
- Oracle
- Stablecoin
- Staking
- Wallet
- NFT
- Blockchain
- Platform
- Governance
PAYOUTS
Smart Contracts, Websites and Applications, Blockchain/DLT
-
Critical: $10,000 - $25,000
- Permanent funds freeze; Protocol Insolvency; Direct theft of any user funds (at-rest, in-motion) unclaimed yield excluded
-
High: $5,000 - $10,000
- Unclaimed yield permanent freeze, Unclaimed yield theft, Profit oriented block stuffing
-
Medium: $1,000 - $5,000
- Unbounded gas consumption, Gas Theft, Smart contract incapacitated due to insufficient token funds, Griefing
-
Low: $50 - $1,000
- Smart contract does not meet the promised returns, yet retains its value.
-
Informational: up to $50
PROGRAM DETAILS
By participating in this program, you agree to:
- Respect the scope of the program
- Don't discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
- Note that Celo is an open source project
- Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced)
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder
- Any attacks that could cause physical damage or incur costs to other's property is prohibited
- Any attacks against Network nodes that violate Amazon Web Services Acceptable Use Policy and Google Cloud Platform's Acceptable Use Policy and other specific services you use is prohibited
- Follow the Celo Community Code of Conduct
The bug bounty program disallows:
- Testing on mainnet or public testnets; use private testnets only
- Testing with pricing oracles or external smart contracts
- Phishing or social engineering attacks against employees/customers
- Testing on third-party systems, apps, or websites
- Denial of service attacks
- Automated testing that generates heavy traffic
- Public disclosure of unpatched vulnerabilities
The following are also in-scope:
- /admin
- Bypassing rate-limits or the non-existence of rate-limits
For checking a fix we will offer a bonus for high, critical and exceptional submissions, this remains at cLabs discretion to award.
Validation timelines:
Once your submission has been verified by Remedy:
- Critical severity: 5 working days
- High severity: 10 working days
- Medium: 15 working days
- Low: 15 working days
Working hours are Monday - Friday 9am - 5pm
IN SCOPE ASSETS
-
Celo L2 execution client, fork of Optimism's op-geth
https://github.com/celo-org/op-geth/
-
Celo-forked OP Stack repository
https://github.com/celo-org/optimism
-
Repository for core projects comprising the Celo platform
https://github.com/celo-org/celo-monorepo/
OUT OF SCOPE
Domains:
- Any domain that is not listed in the Domains section, is out of scope for this program
- Any domain that contains /metrics
Application:
- Wordpress usernames disclosure
- Self-XSS that cannot be used to exploit other users
- Verbose messages/files/directory listings without disclosing any sensitive information
- CORS misconfiguration on non-sensitive endpoints
- Missing cookie flags
- Missing security headers
- Cross-site Request Forgery with no or low impact
- Presence of autocomplete attribute on web forms
- Reverse tabnabbing
- Best practices violations (password complexity, expiration, re-use, etc.)
- Clickjacking without proven impact/unrealistic user interaction
- CSV Injection
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- Tokens leaked to third parties
- Anything related to email spoofing, SPF, DMARC or DKIM
- Content injection without being able to modify the HTML
- Username/email enumeration
- Email bombing
- HTTP Request smuggling without any proven impact
- Homograph attacks
- XMLRPC enabled
- Banner grabbing/Version disclosure
- Not stripping metadata of files
- Same-site scripting
- Subdomain takeover without taking over the subdomain
- Arbitrary file upload without proof of the existence of the uploaded file
- Blind SSRF without proven business impact (pingbacks are not sufficient)
- Disclosed/misconfigured Google Maps API keys
- Host header injection without proven business impact
- Open write access of documents pertain to the community
General:
- In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
- Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
- Spam, social engineering and physical intrusion
- DoS/DDoS attacks or brute force attacks
- Vulnerabilities that only work on software that no longer receive security updates
- Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
- Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
- Reports that state that software is out of date/vulnerable without a proof-of-concept
