Published in


IOST Bug Bounty Program: Building a Secure Blockchain

One month ago, IOST successfully launched its Developer Bounty Program and received many applications from developers. IOST’s developer community on Slack saw significant growth with many people getting involved and joining the ecosystem.

A strong blockchain is not only equipped with features of high throughput and transparency - it must also be robust and resilient, with high security. Security issues can be seen as pain point of blockchain systems but also one of the strongest requirements for blockchain to be adopted in the other industries.

To ensure IOST’s blockchain is highly secure and resilient, we are excited to launch IOST’s second iteration of bounty programs: The Guardian Code Review Plan.

What is the “Guardian Code Review Program”?

The Guardian Code Review Program is a bug bounty program launched by the IOST developer community and invites developers from all over the world to help IOST in reviewing its code, increase the security level of the IOST mainnet, and earn significant bounties in the process.

In this program, IOST will release its development results which is then reviewed and tested by developers worldwide, thus maximizing the security and resilience of mainnet before it launches.

How Developers Can Review the IOST Code?

All released source code is available on IOST’s Github page:

From a security perspective, we invite developers to assess, identify and give us suggestions on any of the following:

  • Flaws of IOST’s general user experience
  • Flaws of functions and designs
  • Information serialization and de-serialization
  • Stability of web connection
  • Buffer management
  • P2P protocols
  • Security of V8VM
  • Security of cryptographic primitive
  • Security of VM
  • Security of executing transactions
  • Security of ledgers
  • Security of smart contract management
  • Security of authentication of contract system
  • Security of IOST wallets, plug-ins etc

Risk Levels And Ranges of Bounties:

Risk levels will be divided incrementally as: A/A+, B/B+, C/C+, D/D+. Bounty rewards will be linked to these risk levels as follows:

  • Potential systematic flaws, including access to server, access to data, access to website administration, transaction manipulations etc.
  • Potential risks of leaks or manipulation of user accounts: private keys, user’s sensitive information and data etc
  • Potential leaks of system’s sensitive information, source code etc
  • Risks of having negative impact on transaction speed of main net or loss of crypto assets
  • Risks of being unable to implement transactions
  • Leaks of insensitive information of users that may not cause direct loss of assets
  • Problems of user experience of IOST main net

How To Report Bugs Detected:

IOST will review and quickly reply once a developer completes the form and submits:

Rules of Bug Bounty Program:

  • The IOST Bug Bounty Program is limited to the latest version of code.
  • Security optimization should follow the principle of self-realization.
  • Problems caused by same source should be considered as 1 bug.
  • Only when the process of “Bug submission — Project verification — Improvements” is completed can a contributor receive the bounties.
  • IOST has the responsibility of publishing its improvements after a bug is detected within 2 weeks.
  • Any vicious attacks, stealing of user data or abuse of intellectual property in the name of reviewing the code will be investigated by IOST.
  • IOST reserves the right of final interpretation.

Developer Community on Slack

This week in our developer community on Slack, many developers also expressed their interests in becoming IOST’s nodes. We would welcome more developers to apply for and participate in IOST’s node election!

Node Application link:

Join our developer community on Slack:

Apply For Developer Bounty Program:

Introduction of Developer Bounty Program:



The Internet of Services Foundation Official Medium Publication

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store