-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
fc7cc08
commit ad4b055
Showing
51 changed files
with
429 additions
and
450 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,8 @@ | ||
# Soul Wallet Bug Bounty Program | ||
# Elytro Wallet Bug Bounty Program | ||
|
||
## Overview | ||
|
||
As of August 20th, 2024, the [soulwallet-core](https://github.com/Soulwallet/soulwallet-core) and [soul-wallet-contract](https://github.com/SoulWallet/soul-wallet-contract) repositories are included in the Soulwallet Bug Bounty Program (the “Program”) to encourage the responsible disclosure of vulnerabilities. | ||
The [soulwallet-core](https://github.com/Soulwallet/soulwallet-core) and [elytro-wallet-contract](https://github.com/SoulWallet/Elytro-wallet-contract) repositories are included in the Elytro Bug Bounty Program (the "Program") to encourage the responsible disclosure of vulnerabilities. | ||
|
||
The Program is focused exclusively on critical and high-severity bugs, with rewards of up to $50,000. Good luck and happy hunting! | ||
|
||
|
@@ -22,15 +22,11 @@ The Program is limited to bugs that fall under the following categories: | |
- Temporary freezing of funds | ||
- Temporary freezing of NFTs | ||
|
||
**Temporary Exclusion** | ||
|
||
- We are aware of issues related to `FCL_elliptic.sol` and are currently working on modifications. Until these modifications are completed, we will not be accepting bug submissions related to `FCL_elliptic.sol`. Thank you for your understanding. | ||
|
||
The following items are not covered under this Program: | ||
|
||
- Any contract found under the `contracts/test` directory. | ||
- Bugs in any third-party contracts or platforms interacting with Soulwallet. | ||
- Issues already reported or discovered in contracts created by third parties on Soulwallet. | ||
- Bugs in any third-party contracts or platforms interacting with Elytro. | ||
- Issues already reported or discovered in contracts created by third parties on Elytro. | ||
- Previously reported vulnerabilities. | ||
|
||
Additionally, vulnerabilities depending on any of the following are also excluded from this Program: | ||
|
@@ -44,7 +40,7 @@ Additionally, vulnerabilities depending on any of the following are also exclude | |
|
||
## Rewards | ||
|
||
Rewards will be determined based on the severity of the reported bug and will be assessed and allocated at the discretion of the Soulwallet team. For critical vulnerabilities that could result in user fund losses, rewards of up to $50,000 may be awarded. Lower severity issues will be rewarded at the team's discretion. | ||
Rewards will be determined based on the severity of the reported bug and will be assessed and allocated at the discretion of the Elytro team. For critical vulnerabilities that could result in user fund losses, rewards of up to $50,000 may be awarded. Lower severity issues will be rewarded at the team's discretion. | ||
|
||
## Reward Calculation for High-Level Reports | ||
|
||
|
@@ -61,7 +57,7 @@ All other impacts classified as Critical will receive a flat reward of USD $5,00 | |
|
||
All discovered vulnerabilities must be reported exclusively to the following email: [[email protected]](mailto:[email protected]). | ||
|
||
The vulnerability must not be publicly disclosed or shared with anyone else until Soulwallet has been informed, the issue has been resolved, and permission for public disclosure has been granted. Furthermore, disclosure must occur within 24 hours of discovering the vulnerability. | ||
The vulnerability must not be publicly disclosed or shared with anyone else until Elytro has been informed, the issue has been resolved, and permission for public disclosure has been granted. Furthermore, disclosure must occur within 24 hours of discovering the vulnerability. | ||
|
||
A detailed report of the vulnerability increases the likelihood of receiving a reward and may lead to a higher reward amount. Please include as much information as possible about the vulnerability, such as: | ||
|
||
|
@@ -75,19 +71,19 @@ Anyone who reports a unique, previously undisclosed vulnerability that results i | |
|
||
To qualify for a reward under this Program, you must: | ||
|
||
- Be the first to disclose the unique vulnerability to [[email protected]](mailto:[email protected]), in accordance with the disclosure requirements above. If similar vulnerabilities are reported within the same 24-hour period, rewards will be divided at Soulwallet's discretion. | ||
- Be the first to disclose the unique vulnerability to [[email protected]](mailto:[email protected]), in accordance with the disclosure requirements above. If similar vulnerabilities are reported within the same 24-hour period, rewards will be divided at Elytro's discretion. | ||
- Provide sufficient information for our engineers to reproduce and fix the vulnerability. | ||
- Not engage in any unlawful conduct when disclosing the bug, including through threats, demands, or other coercive tactics. | ||
- Not exploit the vulnerability in any way, including making it public or profiting from it (other than receiving a reward under this Program). | ||
- Make a good faith effort to avoid privacy violations, data destruction, or interruption or degradation of Soulwallet. | ||
- Make a good faith effort to avoid privacy violations, data destruction, or interruption or degradation of Elytro. | ||
- Submit only one vulnerability per report, unless it is necessary to chain vulnerabilities to demonstrate impact. | ||
- Not submit a vulnerability caused by an underlying issue that has already been rewarded under this Program. | ||
- Not be a current or former employee, vendor, or contractor of Soulwallet, or an employee of any of our vendors or contractors. | ||
- Not be a current or former employee, vendor, or contractor of Elytro, or an employee of any of our vendors or contractors. | ||
- Not be subject to U.S. sanctions or reside in a U.S.-embargoed country. | ||
- Be at least 18 years old or, if younger, submit the vulnerability with the consent of a parent or guardian. | ||
|
||
## Other Terms | ||
|
||
By submitting a report, you grant Soulwallet all rights necessary, including intellectual property rights, to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility and amounts of rewards and the method of payment, are at our sole discretion. | ||
By submitting a report, you grant Elytro all rights necessary, including intellectual property rights, to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility and amounts of rewards and the method of payment, are at our sole discretion. | ||
|
||
The terms and conditions of this Program may be changed at any time. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.