Frankencoin

Frankencoin Bug Bounty Program

Program Description

Frankencoin (ZCHF) is a collateralized, oracle-free stablecoin that tracks the value of the Swiss franc. The coin's strengths are its decentralization and its versatility. It is an ERC20 token and available on 5 chains: Ethereum, Polygon, Arbitrum, Optimism, and Base. The Frankencoin protocol shall be the best it can be, and the security of Frankencoin is the absolute highest priority. Thus, it was audited by leading security firms and Frankencoin calls on the community to help find bugs or vulnerabilities.

Terms, Rules & Standards

This program follows the Platform Standards and the Terms and Conditions. Please review both documents before testing or submitting any reports. They define general rules of engagement, eligibility for bounty rewards, netiquette, confidentiality requirements, and further legal guidelines that apply to all participants.

Asset Lists

High Risk

• Low: CHF 100-160
• Medium: CHF 160-1280
• High: CHF 1280-5120
• Critical: CHF 5120-10000

In Scope:

• CODE Solidity Contracts in Production: https://etherscan.io/token/0xB58E61C3098d85632Df34EecfB899A1Ed80921cB#code

Medium Risk

• Low: CHF 100
• Medium: CHF 100-640
• High: CHF 640-2560
• Critical: CHF 2560-5000

In Scope:

• https://app.frankencoin.com/
• https://api.frankencoin.com/
• https://ponder.frankencoin.com/
• CODE: https://github.com/Frankencoin-ZCHF/frankencoin-dapp

Low Risk

• Low: CHF 100
• Medium: CHF 100
• High: CHF 100-256
• Critical: CHF 256-500

In Scope:

• https://frankencoin.com/
• CODE: https://github.com/Frankencoin-ZCHF/www

Excluded Items

The bug bounty exclusion list comprises targets that are excluded from the program, and no rewards will be granted for reported vulnerabilities on these targets.

• Bugs in Frankencoin contract code which is not deployed in production is out of scope. Repository for reference: https://github.com/Frankencoin-ZCHF/FrankenCoin
• Bugs for the Frankencoin Mobile Wallet Apps need be reported on the DFX.swiss program
• Code forked from external repositories and forked files left untouched
• Code intended for demo, testing purpose (non-production code)
• Any 3rd Party-Services (M365, O365, Atlassian, Azure, Github etc.)

Acknowledgement

The Frankencoin Association may give public acknowledgment to individuals who have identified significant vulnerabilities under the program and received bounties. On Frankencoin Association's acknowledge, Compass might also choose to acknowledge you on websites or printed materials, unless you specifically request your name to be excluded.

References

• Domain related security.txt: https://frankencoin.com/.well-known/security.txt