The Mintlayer bug bounty program

Mintlayer is happy to accept any kind of bugs, although only valid security issues will be eligible for a bounty. Only the first report of any issue will be considered valid and the bug must not exist in any of our internal bug tracking systems or fixed in another branch of the code yet to be merged. All valid security issues will allow the reporter to be listed in our "bug finders list" in the project repo.

Email [email protected] for security issues. For encrypted submissions our PGP key can be found here. Non-security bugs can be sent to [email protected] or opened as issues on the repository.

We will endeavour to respond within 3 working days to verify we can replicate the issue or to ask for further information. The time until a fix is released will depend on the complexity and severity of the issue disclosed. The reporter may not publicly announce the issue until a patch has been released, or until 90 days have passed since the initial report, whichever comes first. Any issue publicly announced without prior authorisation will be considered ineligible for a reward.

Mintlayer bounties will be paid in ML mainnet coins and the bounties awarded will be up to 5,000 USD equivalent (paid in ML coins at the value at time of payment) and the value will depend on the severity of the issue and the difficulty of exploitation using the CVSS score and the opinion of the core development team.

Prior to receiving any reward payment or being listed in the public bug finders list, reporters must complete identity verification (KYC) as required by applicable law. Mintlayer will provide instructions upon reward confirmation. Failure to complete KYC within 30 days of notification will result in forfeiture of the reward.

Security issue ticklist:

• The issue is valid in the latest code release, which has not since been fixed, or in the master branch on the repository.
• This issue has not been previously reported by another bug bounty hunter or discovered internally
• The bug has been reported responsibly
• A bug is only valid if it is found on a network you have created yourself (you should create your own network by modifying the source code in our Code repository). A bug found attacking any Mintlayer run testnet or mainnet will be considered invalid.

Professional Conduct

Mintlayer reserves the right to immediately disqualify any submission and forfeit any pending reward if the reporter engages in threatening, coercive, extortionate, or unprofessional conduct at any point during the disclosure process. This includes, but is not limited to: demands exceeding the published reward structure, threats of public disclosure used as leverage, harassment of Mintlayer personnel, or any conduct constituting extortion under applicable law.

In scope (Mintlayer core node, the Mojito browser extension, Mojito Mobile App and the Mintlayer core repo wallets):

• Double spend attacks
• Secure information leakage (secret keys or mnemonic phrases)
• Transaction tampering
  • Changing amount of a transaction
  • Changing the token in the destination
  • Changing the destination of a transaction
• Remote code execution
• Contract or script tampering
• Other issues will be judged on a case by case basis - email us if you have something you think should apply

Out of scope:

• DOS/DDOS attacks
• Usage of any Mintlayer mainnet or testnet
• MITM attacks or attacks requiring physical access
• Non-best practice SSL/TLS usage
• *.mintlayer.org (that is not mentioned above)
• Bugs in libraries used by Mintlayer that are not related to misuse in the Mintlayer code base
• Bugs in libraries used by Mintlayer already publicly announced elsewhere
• Any issue listed on Mintlayer's repository or known internally (there is a slight lag between an issue being known internally and being listed publicly)
• Issues only affecting non-stable Mintlayer builds such as development builds
• RCE without a proof of concept
• Reports that use another’s account without consent
• Publicly announced issues
• Issues that directly impacted other users in the discovery or proving stages
• Social engineering and phishing attacks
• Reports without reproducible steps
• Reports that cannot be reproduced