Electroneum MyApp Bug Bounty Program

Overview

You can access your ETN Wallet through the ETN App (available on iOS and Android) or the ETN-CWP (Classic Web Portal) at my.electroneum.com. This is the official place to manage your ETN wallet.

Each user is assigned a single ETN wallet upon registration. While users can send and receive ETN, view transaction history, and manage their account across devices, they do not hold the private keys to their wallet. Custodial access is managed by the ETN-Network.

To comply with global financial standards and ensure platform integrity, Know Your Customer (KYC) verification is required for account access and usage. This adds an additional layer of identity assurance and regulatory compliance.

About the ETN-Network

The ETN-Network has developed a mobile-first digital payment ecosystem powered by Electroneum (ETN), a cryptocurrency designed for fast, low-cost transactions. Through the ETN App and my.electroneum.com, users can send ETN globally.

ETN can be used to purchase essential services such as electricity, water, mobile top-ups, and vouchers from major global brands. The platform's design eliminates the need to convert ETN to fiat, offering users a seamless and accessible way to spend digital currency.

In addition, users can earn ETN through AnyTask.com, a freelance marketplace that enables financial inclusion by allowing sellers to receive payments in ETN without needing a bank account. This empowers freelancers worldwide to work flexibly and get paid securely.

The ETN-Network's mission is to make digital payments and earning opportunities available to everyone, especially those in underserved regions. This makes the security of the ETN Wallet Manager and its mobile apps a top priority.

What We're Looking For

The ETN-Network believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you think you have found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

Thank you for helping us keep the ETN-Network and its users safe!

Ratings/Rewards

For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Reward Structure

In Scope Targets

The Staging ETN-Network platform is a staging environment for the wallet app to manage the cryptocurrency Electroneum (ETN). Testing and experimentation should be carried out at: https://my.thesecurityteam.rocks/

The Production ETN-Network is a wallet app to manage the cryptocurrency Electroneum (ETN), accessible at https://my.electroneum.com/ or via the mobile apps.

Program Rules

• When conducting blockchain research, please do not enact any discovered exploits in order to create a POC, for example, minting new tokens, moving users balances around or otherwise affect our user's ability to conduct their usual operations on the blockchain and maintain their wallet balances.

• This program relates to the Electroneum Online Wallet and mobile App production environments. Behaviour that compromises the stability and integrity of the site is out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage in any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it.

• If you feel you have found an exploit that will target all users, please use our staging system to verify it: https://my.thesecurityteam.rocks.

• Testing is only authorized on the targets listed as in scope. Any domain/property of Electroneum not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Electroneum, you can report it to this engagement, and is appreciated. However, be aware that it is ineligible for rewards or points-based compensation.

• Real personal data must not be used in staging environments.

Credentials

For the Electroneum Online Wallet and Mobile App

To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address.

For the Electroneum Staging Platform

Pre-provisioned accounts with access to the application have been provided. The credentials are available for retrieval at the bottom of the brief.

If you wish to retrieve device authorization generated emails from https://my.thesecurityteam.rocks/, you can do so by visiting: http://stagemail.thesecurityteam.rocks/stagemail.php.

Excluded Submission Types

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are excluded from this engagement:

• P5 vulnerabilities
• Non-security impacting UX issues
• Deprecated Third Party Open-Source libraries are not in scope. For our own supported and actively maintained open-source libraries, we accept vulnerability reports through Bugcrowd.
• Vulnerabilities or weaknesses in third party applications that integrate with Electroneum
• Vulnerabilities associated with creating an emulator for the mining environment that do not demonstrate the ability to dramatically increase mining function or show other security impact
• Clickjacking on pages with no sensitive actions
• Attacks requiring MITM or physical access to a user's device
• Previously known vulnerable libraries without a working Proof of Concept
• Any type of injection without demonstrating a vulnerability
• Any activity that could lead to the disruption of our service (DoS)
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Password complexity-related issues
• Rate limiting related issues
• Race condition related issues

N-day/Third Party 0-day Policy

• When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by
• Example: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025

Out of Scope

• Any subdomains on the electroneum.com and thesecurityteam.rocks domains that are not included on the in-scope target list are considered out of scope
• We will not accept reports based on bugfixes that have already publicly been committed to Ethereum
• Interacting or manipulating other stakeholders and their associated accounts including:
  • Social engineering attacks
  • Phishing attacks
  • Physical attacks
  • Third party providers and services

Safe Harbor

When conducting vulnerability research according to this policy, we consider this research to be:

• Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy
• Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls
• Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy
• Lawful, helpful to the overall security of the Internet, and conducted in good faith

You are expected, as always, to comply with all applicable laws.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire before going any further.

Disclosure

This engagement follows Bugcrowd's standard disclosure terms. Vulnerabilities found in this engagement require explicit permission by selecting the disclosure request option on your submission.