Generally speaking, any bug that poses a significant vulnerability to the security or integrity of the Stellar Network could be eligible for reward. However, it’s entirely at our discretion to decide whether a bug is significant enough to be eligible for reward.In general, anything which has the potential for financial loss or data breach is of sufficient severity, including:
- Implementation bugs that can lead to financial loss
- Access to our production servers
- Remote Code Execution
- Protocol bugs
- Crash bug in Stellar-core or Horizon (ex. a bug that can crash the app by sending a special request, not by sending thousands requests)
In general, the following would not meet the threshold for severity:
- Recently disclosed 0-day vulnerabilities
- Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website
- Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attack, etc
- Vulnerabilities affecting outdated or unpatched browsers
- Vulnerabilities in third party applications that make use of Stellar’s API
- Bugs that have not been responsibly investigated and reported
- Bugs already known to us, or already reported by someone else (reward goes to first reporter)
- Issues that aren’t reproducible
- Issues that we can’t reasonably be expected to do anything about
.svg){kind=icon}
