Gitcoin support
Gitcoin.coDiscordContact us
  • Welcome to Gitcoin support
  • GRANTS STACK
    • What is Gitcoin Grants Stack?
      • 🚨Transitioning to Allo v2: What You Need to Know
      • 🦋FAQs for Transitioning to Allo v2
    • ⭐Builder - a guide for Grantees
      • 📰How to create a project in Builder
      • ✏️How to edit your project in Builder
      • 💡Transfer Project Ownership
      • 🌿Transition to Allo v2: Builder Guide
    • ⭐Explorer - a guide for Donors & the General Community
      • 🔍Navigating Explorer
      • 📃How to apply to a round in Explorer
      • 💲How to donate?
      • 🌿Transition to Allo v2: Explorer Guide
    • 🪄Program Managers/Round Operators
      • 💡Add Operators to Round
      • 💡Add Manager to Program
    • 🧑‍💻Grantee FAQs
    • 💰Donor FAQs
      • 👁️How can I view my past donations?
      • 💵How to connect your wallet
      • 🎉How to Mint Your Impact Attestation
    • Mechanisms
      • Quadratic Funding
      • MACI
      • Direct Grants
      • Retroactive Funding
  • Gitcoin Grants
    • What is the Gitcoin Grants program?
    • Bridging
    • How is the Gitcoin Grants program changing?
    • Tips for Grant Success
    • Gitcoin's KYC
    • ⁉️Gitcoin Grants FAQ
      • 📚When is the next Grants Round?
      • 📚What are Public Goods?
      • 📚Why should I contribute?
      • 📚What are the Grants Round rules I need to follow?
      • 🤖What is Quadratic funding?
      • 🤖Why is Quadratic funding powerful?
      • 🤖How do you prevent Sybil attacks?
      • 🤨I see a bug or I've got a question, what do I do?
      • 🎉How much volume has Gitcoin Grants done?
      • 🤔What is our Quid Pro Quo Policy?
  • About Gitcoin
    • What is Gitcoin?
    • Code of Conduct
    • Other Policies
      • Gitcoin Grants Platform and Technology
      • Governance
        • About Grants Round Governance
          • What are we protecting?
          • Why does Quadratic Funding through Gitcoin Grants matter?
          • Red Team vs Blue Team
          • Legitimacy as a North Star for Gitcoin Grants
        • Accepting Round Results
        • Making Policy Updates
        • Subjective Decisions
        • Accepting Workstreams
        • Stewards Role
        • Credible Neutrality
      • GitcoinDAO Role in Grants
      • Collection Levels & Participation Policies
        • Ecosystem Acceptance
        • Round Acceptance
        • Sub-Round Acceptance
        • Side-Round Acceptance
      • Grant Participation Policy
        • The Grant Approval Process
        • Platform Level Grant Participation Policy
        • Ecosystem Level Grant Participation Policy
          • Side Round Ecosystem Policy Documentation
            • Ethereum Ecosystem Participation Policy (GR11, GR10, GR9, etc.)
            • GitcoinDAO Ecosystem Participation Policy
            • All Exclusive Ecosystem Policy Documentation
      • User Participation Policy
        • Round User Participation Policy
        • Ethereum Ecosystem User Participation Policy Documentation
        • Ecosystem Level User Participation Policy
        • Platform Level User Participation Policy
        • User Disputes, Sanctions, and Appeals
      • Understanding Potential Attack Vectors
        • Fraud/Impersonation
        • Collusion Attack
        • Sybil Attack
        • Bribery/Quid Pro Quo
      • Active Defense Measures
        • Sybil Detection by Machine Learning
      • The Gitcoin Mission
    • Contact Us
  • Misc
    • Explorer 🤝 Passport Guide
    • GTC Delegation
      • ✈️Quadratic Lands Token Distribution web3 support- Signed Message Vote
      • ✈️Quadratic Lands Token Distribution web3 support- Token Claim
      • ✈️Quadratic Lands Token Distribution web3 support-Delegate Voting Power
    • 🤔cGrants/Bounties & Hackathons Sunsetting FAQ
      • 🤔What’s happening to the Hackathons and the Bounties program?
      • 🤔How to retrieve my data from cGrants
      • 🤔What is happening to my data?
    • Gitcoin Governance
      • 🏢What are the governance workstreams?
      • 🏢What is the Stewards delegation program?
      • 🏢How do I get involved in Gitcoin governance?
      • 🏢Who chooses Stewards?
      • 🏢How do I become a Gitcoin Steward?
    • Gitcoin Security Bounty Program
    • 🛡️Passport
Powered by GitBook
On this page
  • Guidelines
  • Vulnerability Scope
  • Payouts

Was this helpful?

  1. Misc

Gitcoin Security Bounty Program

Guidelines, scope, and payouts of the Gitcoin Security Bounty Program.

Gitcoin is an open-source marketplace with our code available for inspection and research. If you discover a severe bug affecting our users' privacy, data, or security, we ask that you disclose it responsibly and privately. For security-related vulnerabilities, we reward researchers for private and professional disclosure.

Non-security issues (style issues, gas optimizations) are not eligible for this bounty.

Guidelines

Participating in our security bounty program requires you to follow our guidelines. Responsible investigation and reporting include, but are not limited to the following:

  • Don't download, modify, or destroy other users' data.

  • Don't cause a denial of service on our platform through exploits, vulnerabilities, traffic, or causing issues with our technology providers.

  • Don't repeatedly request updates on your reports. Gitcoin is a small team, and constant requests for updates can render your report ineligible. Allow us up to 7 days to respond to your emails.

  • Do only use your own account to test issues in production. You can also download our open source code and run your own instance to research and test for vulnerabilities.

  • Social engineering attacks, DDOS, physical access, spearfishing, etc., are not eligible.

  • Payouts will be made to the first individuals who submit a report.

The Gitcoin team has the final say in all determinations of bounty payouts, including severity, classification, amount, whether the report falls under our guidelines, etc.

Vulnerabilities should be disclosed directly to the Gitcoin team by emailing engineering@gitcoin.co - reports should not be made publically or to any third party. These communications must remain confidential to be eligible.

Threats, ransom demands, unprofessional language, etc. of any kind will automatically disqualify you from participating in the program.

The only domain eligible for the bounty program is https://gitcoin.co - no subdomains, related services, etc., are within the scope of the program. Vulnerabilities found in support services (ex: Slack, WordPress, etc.) are not eligible.

Vulnerability Scope

Any significant vulnerability may be eligible for an award provided it follows the guidelines set in this document.

Some examples of eligible issues are:

  • Cross-Site Request Forgery (CSRF)

  • Cross-Site Scripting (XSS)

  • Code Executions

  • SQL Injection

  • Server-Side Request Forgery (SSRF)

  • Privilege Escalations

  • Authentication Bypasses

  • Data Leaks

Some examples of ineligible issues are:

  • Rate Limiting

  • Stack Traces

  • Self-XSS

  • Man in the Middle (MiTM) Attacks

  • Denial of Service Attacks

  • Cache Poisoning

  • Clickjacking

  • Missing DNS Records

  • Brute Force Attacks

  • Vulnerabilities in third-party services or third-party platforms

  • Vulnerabilities in past versions of the software

  • Vulnerabilities affecting outdated browsers or operating systems

Eligible Reports must contain enough information and a proof of concept code or screenshots. After a report is made and confirmed, efforts will be made to fix the issue. Researchers agree to assist in the testing of the fixes.

Payouts

Payouts will be awarded in ETH and converted from USD at the time of payout - please include your Ethereum address and Gitcoin username when submitting a report:

Severity
Payout

Critical

$600

High

$225

Medium

$125

Low

$30

To report a security issue directly to Gitcoin devs, please email it to engineering@gitcoin.co

PreviousHow do I become a Gitcoin Steward?NextPassport

Last updated 1 year ago

Was this helpful?

Vulnerability severity is judged by the .

OWASP evaluation chart
OWASP model