Check for Vulnerabilities and report back with suggestions for fix
Budget: $5,000 – $10,000 USD
I am looking for a skilled professional to conduct a comprehensive vulnerability assessment on our websites and codebase. I have no specific concerns or areas of focus, so I would like the assessment to cover all potential vulnerabilities.
Ideal Skills and Experience:
- Extensive knowledge of website security and vulnerability assessment techniques
- Experience in conducting comprehensive assessments on various types of systems and websites
- Familiarity with different coding languages and frameworks
- Strong attention to detail and ability to identify and analyze vulnerabilities
- Ability to generate a detailed technical report outlining all findings and recommendations
Assets in scope
https://github.com/maticnetwork/heimdall/
https://github.com/maticnetwork/bor/
https://static.matic.network/network/mainnet/v1/index.json
Dev or Staging Environment Links
https://wiki.polygon.technology/docs/zkEVM/develop/
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Loss of user funds by permanent freezing or direct theft
Loss of governance funds
Network shutdown
Double spend by getting the clients to accept a different chain
Double spend by validating malicious blocks
Tamper/manipulate blockchain history to invalidate transactions
Cause a user to mint tokens to own account
Undermine consensus mechanism to split the chain
Chain halt and shutting down the network (Total network shutdown)
Steal tokens from node
Theft of unclaimed yield
Freezing of unclaimed yield
Temporary freezing of funds for any amount of time
Unable to call smart contract
Smart contract gas drainage
Denial of service attacks
Prevent node from accessing the network
Censorship (e.g. on checkpoints)
DoS over 30% of validators and does not shut down the network
Smart contract fails to deliver promised returns
Checkpoint manipulation
DoS under 30% of validators and does not shut down the network
The list of all deployed contracts can be found at: https://static.matic.network/network/mainnet/v1/index.json
Impacts only apply to assets in active use by the project like contracts on mainnet or web/app assets used in production
Ideal Skills and Experience:
- Extensive knowledge of website security and vulnerability assessment techniques
- Experience in conducting comprehensive assessments on various types of systems and websites
- Familiarity with different coding languages and frameworks
- Strong attention to detail and ability to identify and analyze vulnerabilities
- Ability to generate a detailed technical report outlining all findings and recommendations
Assets in scope
https://github.com/maticnetwork/heimdall/
https://github.com/maticnetwork/bor/
https://static.matic.network/network/mainnet/v1/index.json
Dev or Staging Environment Links
https://wiki.polygon.technology/docs/zkEVM/develop/
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Loss of user funds by permanent freezing or direct theft
Loss of governance funds
Network shutdown
Double spend by getting the clients to accept a different chain
Double spend by validating malicious blocks
Tamper/manipulate blockchain history to invalidate transactions
Cause a user to mint tokens to own account
Undermine consensus mechanism to split the chain
Chain halt and shutting down the network (Total network shutdown)
Steal tokens from node
Theft of unclaimed yield
Freezing of unclaimed yield
Temporary freezing of funds for any amount of time
Unable to call smart contract
Smart contract gas drainage
Denial of service attacks
Prevent node from accessing the network
Censorship (e.g. on checkpoints)
DoS over 30% of validators and does not shut down the network
Smart contract fails to deliver promised returns
Checkpoint manipulation
DoS under 30% of validators and does not shut down the network
The list of all deployed contracts can be found at: https://static.matic.network/network/mainnet/v1/index.json
Impacts only apply to assets in active use by the project like contracts on mainnet or web/app assets used in production