Crescendo
Bounty Program
Introducing the Crescendo Bounty Program: Celebrating Two Years of Innovation and Launching the testnet Release Bug Bounty!
What is in scope of this bug bounty?
We're seeking any exploitable weaknesses in smart contract code, transactions, or scripts that could destabilize the Flow network, such as crashing or significantly slowing down network nodes.
Help us safeguard the Cadence & EVM runtime environment from unauthorized control and protect the non-public state of accounts from privilege escalation. Your expertise could earn you substantial rewards and contribute to a more secure Flow network!
We welcome any bug reports that clearly demonstrate unintended behavior and significantly impact Flow dApp builders or users.
Bounty Tiers
Key Areas of Change and Potential Bugs
Here are the main areas that underwent significant changes and may contain edge cases or bugs. Help us perfect the Flow network and earn rewards!
- New/Updated Functionality
- Circumvention of resource semantics, such as unauthorized construction, duplication, or use-after-destruction.
- Type confusion, such as using functionality designed for a certain type (parameter) with a value of another type.
Discover Cadence source code and Flow node software source code.
Privilege elevation/bypassing sandbox protections for file system access controls, services/processes, and restricted memory access. For example:
- Gaining control of the machine hosting the Cadence & EVM runtime environment (e.g., the node’s private keys) via adversarial transactions and/or smart contracts.
- Accessing private keys of a node hosting the Cadence & EVM runtime.
- Gaining access to the Random Number Generator's internal state, leading to reliable prediction of future outcomes of on-chain randomness (see Flow’s VRF for more details).
Discover Cadence source code and Flow node software source code.
- Withdrawing from a FT vault without proper access.
- Hijacking another user's account.
- Accessing private data belonging to other users.
- Gaining inappropriate access to sensitive and/or private information, such as a contract accessing private fields of another contract.
- Making unauthorized changes to the application or its data.
- Bypassing business logic rules around account changes.
- Bypassing authorization and authentication mechanisms.
- Bugs / vulnerabilities in the Exposed API endpoints.
- Data corruption or loss.
- Unreachable data due to data migration or transaction/script execution.
Where can you test?
Testing of the Crescendo preview release can be performed in the Crescendo migration environment. All vulnerabilities must be reported in accordance with the Flow Responsible Disclosure Process.
What is outside of scope of this bug bounty?
Please refer to the Flow Protocol and Web Application exclusions listed in the Flow Responsible Disclosure.
Start building on Flow
Developer-friendly layer 1 blockchain with EVM equivalence enabling seamless user experiences, secure assets, and low fees.