By participating in this program, you agree to:

• Respect the Community Code of Conduct

• Respect the Intigriti Terms and Conditions

• Respect the scope of the program

• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

• Note that Celo is an open source project.

• Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.

• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

• Attacking any testnet other than the official Celo Baklava testnet (“Network”) is prohibited.

• Any attacks that could cause physical damage or incur costs to other’s property is prohibited.

• Any attacks against Network nodes that violate Amazon Web Services Acceptable Use Policy and Google Cloud Platform's Acceptable Use Policy and other specific services you use is prohibited.

• Follow the Celo Community Code of Conduct.

• Participation is subject to the Baklava testnet Terms & Conditions.

The following are also inscope.

• */admin
• Bypassing rate-limits or the non-existence of rate-limits.

For checking a fix we will offer a bonus for high, critical and exceptional submissions, this remains at cLabs discretion to award

We aim to validate all submissions within the below timelines (once your submission has been verified by Intigriti):

Exceptional 3 working days
Critical 5 working day
High 10 working days
Medium 15 working days
Low 15 working days

Working hours = Mo-Fr 9am - 5pm

Domains

• Any domain that is not listed in the Domains section, is out of scope for this program
• Any domain that contains */metrics

Application

• Wordpress usernames disclosure
• Self-XSS that cannot be used to exploit other users
• Verbose messages/files/directory listings without disclosing any sensitive information
• CORS misconfiguration on non-sensitive endpoints
• Missing cookie flags
• Missing security headers
• Cross-site Request Forgery with no or low impact
• Presence of autocomplete attribute on web forms
• Reverse tabnabbing
• Best practices violations (password complexity, expiration, re-use, etc.)
• Clickjacking without proven impact/unrealistic user interaction
• CSV Injection
• Sessions not being invalidated (logout, enabling 2FA, etc.)
• Tokens leaked to third parties
• Anything related to email spoofing, SPF, DMARC or DKIM
• Content injection without being able to modify the HTML
• Username/email enumeration
• Email bombing
• HTTP Request smuggling without any proven impact
• Homograph attacks
• XMLRPC enabled
• Banner grabbing/Version disclosure
• Not stripping metadata of files
• Same-site scripting
• Subdomain takeover without taking over the subdomain
• Arbitrary file upload without proof of the existence of the uploaded file
• Blind SSRF without proven business impact (pingbacks are not sufficient)
• Disclosed/misconfigured Google Maps API keys
• Host header injection without proven business impact
• Open write access of documents pertain to the community

General

• In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
• Spam, social engineering and physical intrusion
• DoS/DDoS attacks or brute force attacks
• Vulnerabilities that only work on software that no longer receive security updates
• Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
• Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
• Reports that state that software is out of date/vulnerable without a proof-of-concept

This program follows Intigriti's contextual CVSS standard

Test Plan

1. Set up a node on the network following these instructions: Getting Started - Running a Full Node.

2. If you are new to blockchains and/or to Celo, take a look at the Celo overview

3. Explore the code on GitHub - the two main repositories are celo-monorepro and celo-blockchain.

4. You’re now set up to start looking for vulnerabilities.

Have questions?
Checkout the Forum and join the discussion on Discord