IOST Bug Bounty Program: Building a Secure Blockchain
One month ago, IOST successfully launched its Developer Bounty Program and received many applications from developers. IOST’s developer community on Slack saw significant growth with many people getting involved and joining the ecosystem.
A strong blockchain is not only equipped with features of high throughput and transparency - it must also be robust and resilient, with high security. Security issues can be seen as pain point of blockchain systems but also one of the strongest requirements for blockchain to be adopted in the other industries.
To ensure IOST’s blockchain is highly secure and resilient, we are excited to launch IOST’s second iteration of bounty programs: The Guardian Code Review Plan.
What is the “Guardian Code Review Program”?
The Guardian Code Review Program is a bug bounty program launched by the IOST developer community and invites developers from all over the world to help IOST in reviewing its code, increase the security level of the IOST mainnet, and earn significant bounties in the process.
In this program, IOST will release its development results which is then reviewed and tested by developers worldwide, thus maximizing the security and resilience of mainnet before it launches.
How Developers Can Review the IOST Code?
All released source code is available on IOST’s Github page: https://github.com/iost-official/go-iost
From a security perspective, we invite developers to assess, identify and give us suggestions on any of the following:
1.General Security of Blockchain:
- Flaws of IOST’s general user experience
- Flaws of functions and designs
2.Web Security
- Information serialization and de-serialization
- Stability of web connection
- Buffer management
3.Security of Protocols
- P2P protocols
- Security of V8VM
- Security of cryptographic primitive
- Security of VM
4.Security of Transactions
- Security of executing transactions
- Security of ledgers
5.Security of Smart Contracts
- Security of smart contract management
- Security of authentication of contract system
6.Security of Other Applications
- Security of IOST wallets, plug-ins etc
Risk Levels And Ranges of Bounties:
Risk levels will be divided incrementally as: A/A+, B/B+, C/C+, D/D+. Bounty rewards will be linked to these risk levels as follows:
Lvl 1 Risk: A/A+ Bounty: 120,000–500,000 IOST
- Potential systematic flaws, including access to server, access to data, access to website administration, transaction manipulations etc.
Lvl 2 Risk: B/B+ Bounty: 60,000–120,000 IOST
- Potential risks of leaks or manipulation of user accounts: private keys, user’s sensitive information and data etc
- Potential leaks of system’s sensitive information, source code etc
- Risks of having negative impact on transaction speed of main net or loss of crypto assets
Lvl 3 Risk: C/C+ Bounty: 30,000–60,000 IOST
- Risks of being unable to implement transactions
- Leaks of insensitive information of users that may not cause direct loss of assets
Lvl 4 Risk: D/D+ Bounty: 10,000–30,000 IOST
- Problems of user experience of IOST main net
How To Report Bugs Detected:
IOST will review and quickly reply once a developer completes the form and submits:
Rules of Bug Bounty Program:
- The IOST Bug Bounty Program is limited to the latest version of code.
- Security optimization should follow the principle of self-realization.
- Problems caused by same source should be considered as 1 bug.
- Only when the process of “Bug submission — Project verification — Improvements” is completed can a contributor receive the bounties.
- IOST has the responsibility of publishing its improvements after a bug is detected within 2 weeks.
- Any vicious attacks, stealing of user data or abuse of intellectual property in the name of reviewing the code will be investigated by IOST.
- IOST reserves the right of final interpretation.
Developer Community on Slack
Developer’s participation in IOST node applications
This week in our developer community on Slack, many developers also expressed their interests in becoming IOST’s nodes. We would welcome more developers to apply for and participate in IOST’s node election!
Node Application link: https://iost-eng.typeform.com/to/MQzgbm
Join our developer community on Slack: invite.iost.io
Apply For Developer Bounty Program: https://goo.gl/forms/fCh32utJ7AjPqJKC2
Introduction of Developer Bounty Program: https://medium.com/iost/the-iost-developer-bounty-program-1e768ec41452
