Fantom Bug Bounty Program - DropsEarn
Fantom Bug Bounty Program

Fantom Bug Bounty Program

    As the Fantom ecosystem continues to grow, issues will arise. In order to encourage the community to identify, report, and assist in solving these issues, we are announcing an official bug bounty program.

    Reward pool
    Not set
    Expected profit
    ~ $250 - 5,000
    Max participants
    DropsEarn score
    Neutral

  • Activity Type: Bug bounty
  • Date: 30 Jun 2020 00:00(UTC+3) - 30 Sep 2020 00:00(UTC+3)
  • Registration: Closed
  • Event status: You can't participate (Event ended)
  • Links: Official Announcement
Go to event page

Reward

The rewards tiers are as follows:
 

  1. Low severity (without solution): $250
  2. Low severity (with solution): $400
  3. Medium severity (without solution): $500
  4. Medium severity (with solution): $750
  5. High severity (without solution): $1000
  6. High severity (with solution): $1500
  7. Critical severity (without solution): $2500
  8. Critical severity (with solution): $5000

We are most interested in issues that affect applications such as wallets (primarily back-end), smart contracts (including the SFC and governance contract), and go-lachesis itself. Issues that affect other services such as the website (https://fantom.foundation) and explorer (https://explorer.fantom.network) will also be considered, but are likely to be of low severity.

Issues related to third-party software that merely uses Fantom’s APIs (third party wallets and explorers, for example) will not be considered for a reward, as there is nothing we can reasonably do to prevent these.

Eligibility

  • Eligibility and classification of submissions is wholly at the discretion of the Foundation.
  • In order to make a submission, you must email bugs@fantom.foundation, with a description of the issue (with as much detail as possible, including steps required to reproduce it), and a suggested solution (if available).
  • We will accept a solution if it solves the issue, or contributes significantly to a solution. One reward per bug is available, and only the first eligible submission for each will receive a reward.
  • Please do not DM or email team members directly. Otherwise, we may not see your submission.
  • Note that if a submission becomes public, or is publicly reported before being fixed, then the submitter will be disqualified from any reward.
  •  
  • Eligibility is also contingent on responsible investigation and reporting. Investigations that are pursued by means of exploitation, denial of service (DDoS), disruption to our operations, or any other action that could be construed as an attack, will not be eligible for a reward.