All bugs will be evaluated according to the CVSS scoring scale and rewarded accordingly. The CVSS levels are:

How it works

Additionally, in order to qualify for rewards you must adhere to the following responsible disclosure policy:

1. For Zelcore related issues: exploits and bugs are restricted to your own account or instance of the Zelcore wallet and have been carried out for validation purposes only.

2. For website related issues: No data is removed from the website upon discovery.

3. The Flux Blockchain and nodes: Any and all exploits be confined to a private testnet or regtest for validation purposes. Any code modifications carried out to run exploits need to be disclosed along with the effects for full validation.

4. For the FluxOS distributed operating system, any and all exploits are confined to their own nodes for validation purposes. Should additional nodes be required to fully validate more serious exploits, the Flux team will assist with a private testnet.

5. Submissions can only be made to [email protected] or via direct message to a developer on Discord in either case using the attached PGP keys for encryption is a requirement.
   

6. Include an email for responses in your report.

7. Adhere to timeframes laid out in initial confirmation of report emails.

Please note that we have the right to remove you from the bug bounty program and disqualify you from receiving any bounty rewards if you are in violation of any national, state, or local law or regulation.

Qualifying bugs

The following list is by no means exhaustive, so if you have a bug that is not on either the qualifying or non-qualifying lists, report it, it will be covered.

1. Injection flaws such as SQL, noSQL, Mongodb or OS injection that tricks command interpreter into executing unintended commands without proper authorization.

2. Broken authentication/session management that allows compromise of passwords, keys or session tokens.

3. Sensitive data exposure due to improper protection of data via insecure API or flaw in cryptography implementation.

4. Cross-Site Request Forgery (CSRF) for sensitive functions in a privileged context.

5. Remote Code Execution (RCE).
   

6. Insecure direct object references.

7. Privilege escalation.

8. Directory traversal.

9. Open redirects.

10. Spoofing enablement.

11. Any significant abuse-related methodologies that could lead to significant harm.

Non-qualifying bugs

1. Non-original or previously disclosed/reported bugs (with fixes currently underway).

2. Non-technical attacks such as social engineering, phishing, or physical attacks against entities or infrastructure.

3. Any degrading/damaging the reliability or integrity of our services (such as DDoS attacks, man in the middle attacks, spamming, and similar questionable acts).

4. Any software not directly produced by the Flux team.

5. Domains hosted by third parties (e.g.: Github, Gitlab, etc).
   

6. Subdomains operated by third parties (e.g: info.runonflux.io).

7. Any Flux branded services operated by third parties.

How to report a bug

Send an email using the below PGP keys to [email protected] and no other email address. Failing to use the attached PGP keys for the bug report will invalidate any security issues higher than level 2 on the CVSS scale.

Process to follow

1. Write up a report on your findings.

2. PGP Encrypt the report with keys from URL.

3. Within 24 hours you will have an acknowledgement.

4. Adhere to timeline and additional information requests from the Flux team outlined in the acknowledgement email.

5. Discuss publication times and names.
   

6. Collect bounty.

7. Get published.

PGP key