Bug Bounty

Smart contract bug bounty program

This program covers all currently deployed 1hive related smart contracts on the xDai network that are actively being used from the 1Hive Github organisation. Contracts that 1hive uses that are not built by 1hive community members may also be considered depending on the extent to which they have been used within the 1hive ecosystem and the consequences they could produce. This evaluation will be at the discretion of the bug bounty swarm members using the CVSS Risk Rating scale and funds available are held in an Aragon DAO. The members and a link to the DAO holding the funds can be seen in the Bug Bounty Swarm details.

Requirements

• Disclosure of issues must be made directly to one of the bug bounty swarm members. DM’s via discord is fine.

• Any evidence of disclosure to other parties will forfeit the reward.

• Exploiting the vulnerability prior to disclosing it will forfeit the reward.

• Disclosure should include details of how to reproduce the bug in as clear a way as possible. A more detailed report could increase the reward.

• Reporting a bug that has already been reported will not earn a reward.

• Front-end bugs will not earn a reward.

Rewards

The severity of an issue will be determined by a score created using the CVSS Risk Rating scale https://www.first.org/cvss/calculator/3.0. It will likely also involve some subjective understanding of the potential impact it could make on the 1hive ecosystem.

Risk Rating	Payment
Critical (9.0-10.0):	Up to $40,000 in HNY
High (7.0-8.9):	Up to $10,000 in HNY
Medium (4.0-6.9):	Up to $2,000 in HNY
Low (0.1-3.9):	Up to $1,000 in HNY

For reference, I would have scored the exploit detailed here Story of a Bee - Why Farming was Delayed with 9.3 earning it up to $40,000 in HNY, the exact amount would likely need to be discussed but I would have proposed it be closer to the upper limit. The scoring I have chosen can be seen here: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L 3

It should be known that 1hive is interested in maintaining secure infrastructure and is willing to make fair payouts for finding bugs that could affect funds and users. These requirements and rates have been discussed and agreed upon by the community here 1Hive Contract Bug Bounty Program Proposal and here Final 1Hive Contract Bug Bounty Program Proposal so as a bug hunter you can be assured when it comes to claiming a reward you will receive it, provided you act as outlined above.

Bounty Payouts

$2000 in Honey for an email spoofing vulnerability: https://forum.1hive.org/t/email-spoofing-vulnerability-payout/2187