MultiversX The Great Heist Incentivized Competition

Details

MultiversX intends to make blockchain technology more widespread by drastically simplifying user experience and overcoming onboarding hurdles.

Today, it's time to take a new step in that direction with the Guardians feature - new security layer that offers an additional safeguard for user accounts. Guardians act as trusted co-signers, providing a multi-signature implementation at the protocol level. What this means is that once you guard your account using this new feature, your transactions will only be accepted and processed by the blockchain network if they have both your signature and the signature of the set guardian. The setting of a guardian on your account will be abstracted with an intuitive user interface in the wallet. Same as with the signing of your transactions, you will just have to introduce a valid 2FA code, and the registered guardian will co-sign the transactions.

To ensure the security and reliability of this new feature, MultiversX is launching an incentivized competition on the MultiversX public testnet: The Great Heist. By participating in this competition, you’ll learn how to use the feature, have fun and help ensure that Guardians is battle tested through as many scenarios as possible. Moreover, you could be one of the awarded actors in the Great Heist.

MultiversX invites security experts, community members and creative participants to submit security findings, tool development, documentation, guides and share a prize pool of $20,000 in EGLD. If you want to participate, please submit your entry (for any of the three Competition Categories) by completing the Registration Form.

The Great Heist competition

The objective of the heist event is to provide participants with a comprehensive understanding of the benefits of Guardians, identify areas that require more documentation, and assess the level of complexity involved in using this feature. The final aim is to introduce an easy-to-use and secure version of Guardians on the mainnet, one that has been battle-tested and adapted to what the community really needs. Based on the insights gained from the event, MultiversX might make adjustments to the timeline, rules and functionality, to ensure a smooth and effective rollout.

As part of the campaign development, the project encourages everyone to familiarize themselves with the available documentation at MultiversX Docs. This provides an opportunity for individuals to explore and assess the accessibility of the necessary information. MultiversX highly values any feedback regarding the user experience. You can also contribute by submitting to the “Contribution” track.

Prior to the campaign announcement, a designated account has been funded with the following testnet funds:

• 20 xEGLD;
• 249 wEGLD;
• 20,000,000 MEX;
• 1 EGLDMEXLP (0.5 EGLDMEXLP in wallet and 0.5 EGLDMEXLP staked in the EGLD - MEX farm);
• 1 NFT.

Afterwards, a guardian has been established using the TCS (Trusted Co-Signer) and activated by sending a “GuardAccount” transaction. To engage participants, we have decided to intentionally leak the seed phrase and invite everyone to test their skills in attempting to breach the vault's security. Please note that the seed phrase will be leaked three hours after the announcement.

MultiversX encourages all participants to take this time interval to thoroughly familiarize themselves with the provided documentation.

To keep the challenge dynamic, periodically, MultiversX will cancel any pending guardianship by initiating a guarded SetGuardian transaction. This action mimics what anyone might naturally do in such a scenario until the funds will be sent to a safe “vault”. By incorporating these periodic changes, MultiversX ensures that participants must consistently adapt their strategies to progress in the campaign.

Following a period of seven days of competition, all assets will be transferred to a secure address. This address will be publicly disclosed during the campaign. In the event that this transfer is successfully executed, the Security prize will not be awarded. However, all creative attempts to breach the vault will still be evaluated and remain eligible for the creativity prize. This additional twist adds an element of suspense and challenges participants to think outside the box, emphasizing both the importance of security and the value of innovative solutions.

The Great Heist has three main divisions:

Security - $10,000 USD in EGLD

Improve the security of the Guardians feature by finding security issues or platform vulnerabilities that can be exploited either to steal funds, drain the account or disrupt normal operations.

In the scope:

• MultiversX Wallet;
• MultiversX DeFi Wallet-extension;
• Protocol feature by programmatically interacting with the vault through proxy or directly through the node;
• TCS service.

Not in the scope:

• Availability* of MultiversX Wallet & DeFi Wallet-extension ;
• Devnet or Mainnet MultiversX Wallet & DeFi Wallet-extension ;
• xPortal App;
• Other wallets or dApps;

Valid claims can be made through a well-documented entry in the Registration Form, or well-executed attacks, followed by proper documentation. First come, first served for the same issue.

Security prize distribution:

• $1,000 in EGLD will be awarded for validated submitted draining vulnerabilities;
• $9,000 in EGLD will be awarded for validated submitted transfer transactions (be it xEGLD, wEGLD, MEX or NFT) vulnerabilities with respect to the following rules: If multiple different vulnerabilities are submitted, the prize pool will be divided among all the submitters. In the case of a single vulnerability submission, only the first submitter will be awarded the prize.

The submitter MUST prove ownership of the account where the assets were transferred.

*DDOS-ing or other similar attacks on the website will not be rewarded. We’re looking to assess the functionality and security under normal circumstances.

Creativity - $5,000 USD in EGLD

MultiversX believes that Guardians is an important addition to MultiversX suite of products and services. With your collaboration, MultiversX can ensure that this new feature is dependable, secure, and well-suited for our communities' needs. The project encourages you to explore the various use cases and possibilities that Guardians opens up and be creative in your approach. Additionally, MultiversX will reward the best ideas for "robbing the vault".

Contribution - $5,000 USD in EGLD

• Make useful suggestions;
• Improve existing documentation, write new documentation (from developer, integrator, user point of view), create guides and guidelines;

You will be able to submit your contributions via the Registration Form here.

Items will be ranked based on execution, utility, and originality. So make sure you pick a useful topic, cover it well and in an exciting way. Be aware that trivial topics like “How to set a guardian”, “How to guard an account”, etc, may have already been covered in the documentation. Only the best-executed items will be selected from similar ones.

How to join the campaign:

1. Visit heist.multiversx.com and submit your entry using the Registration Form.
2. You will be requested to add a description to your submission, enter a MultiversX address (erd1…) to receive the prize (if you are eligible) and a Telegram ID to keep in touch.

Participants who are eligible for rewards will be required to complete a KYC process afterwards.

Rewards

Throughout the event, the project might need to make several changes, like resetting the pending guardians (by sending a guarded SetGuardian transaction), updating the wallet or resetting the TCS service. This is to be expected while validating the capabilities of a platform under heavy testing conditions.

Submissions will be analyzed and rewards will be distributed by the 14th of June. During this period, it is possible that many of the submitters will be tagged (the team will NOT DM) on the channels for further discussions regarding their submitted entries.

The rewards will be distributed in EGLD tokens, at the 7-day average EGLD/USDT parity.

Links

• Website
• Twitter
• Telegram