Bug Bounty Program

Consensys bug bounty program

At Consensys, we take cybersecurity seriously and value the contributions of the security and DeFi community. As the leading blockchain company, our bug bounty program (also known as vulnerability disclosure program), is the right place for skilled security researchers and bug bounty hunters to be recognized and rewarded for reporting vulnerabilities or weaknesses in our technology,  keeping our DeFi community safe.

If you believe you’ve identified a potential security vulnerability in our products or services, please report it to us using one of the following options disclosed in this Program.

Your participation in this Bug bounty program is voluntary and subject to the terms and conditions set forth here.  By reporting a vulnerability to ConsenSys, you acknowledge that you have read and agreed to fully comply with the rules disclosed in this program.

Reporting a vulnerability

Bugs and vulnerabilities can be reported using these options:

• Public reports can be submitted through the HackerOne platform https://hackerone.com/consensys

• If you cannot use HackerOne, we appreciate direct reports sent to bugbounty@consensys.net. These reports are not eligible for Bug Bounty rewards.

Disclosure Policy

• Please do not disclose your findings outside this program until we have had the opportunity to review and address them with you.

• Follow HackerOne’s disclosure guidelines.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

• Social engineering (e.g. phishing, vishing, smishing) is prohibited.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Rewards

Please see the structured bounty table in HackerOne. Our bounty table provides general guidelines, and all final decisions are at the discretion of ConsenSys.

Exclusions

The following issues are excluded from reward unless otherwise directed by ConsenSys:

• Missing best practices that are not an immediate threat, including but not limited to

  • SSL/TLS configuration,

  • Content Security Policy,

  • HttpOnly or Secure flags on cookies.

  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)

  • Open redirect – unless an additional security impact can be demonstrated

• Any activity that could lead to the disruption of our service (DoS).

• Attacks requiring MITM or physical access to a user’s device.

• Issues that require unlikely user interaction

• Previously known vulnerable libraries without a working Proof of Concept.

• Clickjacking on pages with no sensitive actions

• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

• Comma Separated Values (CSV) injection without demonstrating a vulnerability

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

• Rate limiting or bruteforce issues on non-authentication endpoints

• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]

• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).

• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.

• Open redirect – unless an additional security impact can be demonstrated

Safe Harbor

By responsibly submitting your findings to Consensys in accordance with these guidelines, Consensys agrees not to pursue legal action against you. Consensys reserves all legal rights in the event of noncompliance with these guidelines. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Consensys, our users and our community safe!