Description

cLabs supporting $CELO cryptocurrency in building financial technology to enable prosperity for all

Bounties
Low
Medium
High
Critical
Exceptional
Tier 1
$150
$975
$1,875
$3,000
$3,750
$150 - $3,750
Tier 2
$100
$650
$1,250
$2,000
$2,500
$100 - $2,500
Tier 3
$50
$325
$625
$1,000
$1,250
$50 - $1,250
Rules of engagement
Not applicable
Not applicable
max. 10 requests/sec
Not applicable

By participating in this program, you agree to:

  • Respect the Community Code of Conduct

  • Respect the Intigriti Terms and Conditions

  • Respect the scope of the program

  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

  • Note that Celo is an open source project.

  • Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.

  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

  • Attacking any testnet other than the official Celo Baklava testnet (“Network”) is prohibited.

  • Any attacks that could cause physical damage or incur costs to other’s property is prohibited.

  • Any attacks against Network nodes that violate Amazon Web Services Acceptable Use Policy and Google Cloud Platform's Acceptable Use Policy and other specific services you use is prohibited.

  • Follow the Celo Community Code of Conduct.

  • Participation is subject to the Baklava testnet Terms & Conditions.

Domains

https://celo.org

Tier 1
URL

https://*.celo.org

Tier 2
URL

mento.finance

Tier 2
URL

https://github.com/celo-org/celo-blockchain

Tier 3
URL

Data privacy vulnerabilities are the core focus of this github repo

In scope

The following are also inscope.

  • */admin
  • Bypassing rate-limits or the non-existence of rate-limits.

For checking a fix we will offer a bonus for high, critical and exceptional submissions, this remains at cLabs discretion to award

We aim to validate all submissions within the below timelines (once your submission has been verified by Intigriti):

Exceptional 3 working days
Critical 5 working day
High 10 working days
Medium 15 working days
Low 15 working days

Working hours = Mo-Fr 9am - 5pm

Out of scope

Domains

Application

  • Self-XSS that cannot be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking on pages with no sensitive actions
  • CSV Injection
  • Blind SSRF without proven business impact (DNS pingback only is not sufficient)
  • Disclosed and/or misconfigured Google API key (including maps)
  • Host header injection without proven business impact
  • Sessions not being invalidated (logout, enabling 2FA, ..)
  • Hyperlink injection/takeovers
  • Mixed content type issues
  • Cross-domain referer leakage
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection
  • Username / email enumeration
  • E-mail bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing / Version disclosure
  • Open ports without an accompanying proof-of-concept demonstrating vulnerability
  • Weak SSL configurations and SSL/TLS scan reports
  • Not stripping metadata of images
  • Disclosing API keys without proven impact
  • Same-site scripting
  • Subdomain takeover without taken over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted
  • Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty.
  • Reports that state that software is out of date/vulnerable without a proof-of-concept

Mobile

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
  • API key leakage used for insensitive activities/actions
  • Attacks requiring physical access to the victim's device
Severity assessment

This program follows Intigriti's contextual CVSS standard

FAQ

Test Plan

  1. Set up a node on the network following these instructions: Getting Started - Running a Full Node.

  2. If you are new to blockchains and/or to Celo, take a look at the Celo overview

  3. Explore the code on GitHub - the two main repositories are celo-monorepro and celo-blockchain.

  4. You’re now set up to start looking for vulnerabilities.

Have questions?
Checkout the Forum and join the discussion on Discord

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Program specifics
no reputation No collaboration
Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Overall stats
submissions received
296
average payout
N/A
accepted submissions
37
total payouts
$17,950
Last 90 day response times
avg. time first response
< 24 hours
avg. time to decide
+3 weeks
avg. time to triage
< 2 days
Activity
1/26
cLabs
closed a submission
1/26
cLabs
closed a submission
1/25
logo
created a submission
1/25
logo
created a submission
1/25
cLabs
closed a submission
1/25
logo
created a submission
1/24
cLabs
closed a submission
1/23
logo
created a submission
1/23
cLabs
closed a submission
1/23
cLabs
closed a submission