Description

cLabs supporting $CELO cryptocurrency in building financial technology to enable prosperity for all

Bounties
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 9.4
Exceptional
9.5 - 10.0
Tier 1
$
3,000
5,000
8,000
9,000
10,000
Tier 1
$3,000 - $10,000
Tier 2
$
1,000
3,000
5,000
8,000
9,000
Tier 2
$1,000 - $9,000
Rules of engagement
Not applicable
Not applicable
max. 10 requests/sec
Not applicable

By participating in this program, you agree to:

  • Respect the Community Code of Conduct

  • Respect the Intigriti Terms and Conditions

  • Respect the scope of the program

  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

  • Note that Celo is an open source project.

  • Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.

  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

  • Attacking any testnet other than the official Celo Baklava testnet (“Network”) is prohibited.

  • Any attacks that could cause physical damage or incur costs to other’s property is prohibited.

  • Any attacks against Network nodes that violate Amazon Web Services Acceptable Use Policy and Google Cloud Platform's Acceptable Use Policy and other specific services you use is prohibited.

  • Follow the Celo Community Code of Conduct.

  • Participation is subject to the Baklava testnet Terms & Conditions.

Domains
Tier 1
URL
Tier 1
URL

https://github.com/celo-org/*

Tier 1
Wildcard

Data privacy vulnerabilities are the core focus of this github repo

Tier 1
URL
Tier 1
URL

https://*.celo.org

Tier 2
Wildcard
Tier 2
URL
Out of scope
URL
Out of scope
URL
Out of scope
URL
In scope

The following are also inscope.

  • */admin
  • Bypassing rate-limits or the non-existence of rate-limits.

For checking a fix we will offer a bonus for high, critical and exceptional submissions, this remains at cLabs discretion to award

We aim to validate all submissions within the below timelines (once your submission has been verified by Intigriti):

Exceptional 3 working days
Critical 5 working day
High 10 working days
Medium 15 working days
Low 15 working days

Working hours = Mo-Fr 9am - 5pm

Out of scope

Domains

  • Any domain that is not listed in the Domains section, is out of scope for this program
  • Any domain that contains */metrics

Application

  • Wordpress usernames disclosure
  • Self-XSS that cannot be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Tokens leaked to third parties
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing/Version disclosure
  • Not stripping metadata of files
  • Same-site scripting
  • Subdomain takeover without taking over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file
  • Blind SSRF without proven business impact (pingbacks are not sufficient)
  • Disclosed/misconfigured Google Maps API keys
  • Host header injection without proven business impact
  • Open write access of documents pertain to the community

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
Severity assessment

This program follows Intigriti's contextual CVSS standard

FAQ

Test Plan

  1. Set up a node on the network following these instructions: Getting Started - Running a Full Node.

  2. If you are new to blockchains and/or to Celo, take a look at the Celo overview

  3. Explore the code on GitHub - the two main repositories are celo-monorepro and celo-blockchain.

  4. You’re now set up to start looking for vulnerabilities.

Have questions?
Checkout the Forum and join the discussion on Discord

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Program specifics
no reputation No collaboration
Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Overall stats
submissions received
557
average payout
N/A
accepted submissions
83
total payouts
$34,300
Activity
12/11
cLabs
closed a submission
12/11
cLabs
accepted a submission
11/30
cLabs
suspended the program
11/30
logo
created a submission
11/30
cLabs
closed a submission
11/30
cLabs
unsuspended the program
11/30
cLabs
closed a submission
11/29
cLabs
suspended the program
11/29
logo
created a submission
11/29
cLabs
unsuspended the program