Binance

Description

For security issues related to cryptocurrencies and their components ONLY: If you have found a security issue that directly affects a cryptocurrency and/or its components (e.g. blockchain, node, wallet), please ensure that you report it directly to the program. Non-security related issues: To report an issue without security impact, please open a support chat at https://www.binance.com/en/support (chat icon is located at the bottom right of the page). Thank you for your efforts in helping keep Binance and its users safe! About: Binance is the world’s leading blockchain ecosystem and cryptocurrency infrastructure provider with a financial product suite that includes the largest digital asset exchange by trading volume. Trusted by millions worldwide, the Binance’s platform is dedicated to increasing the freedom of money for people all around the world, by providing access to broad financial tools across a growing, wide network while maintaining the lowest fees in the business. Binance’s mission is to be the infrastructure provider to the blockchain ecosystem. Today, Binance is a global blockchain ecosystem spanning across trading services, infrastructure solutions, educational resources, research, social good and charitable programs, investment and incubation initiatives, and more. The Binance ecosystem also includes partners such as Trust Wallet, CoinMarketCap, and more. For more information, visit www.binance.com Policy: At Binance, the security of our users is our number one priority. As such, we strive to provide the most secure platform possible. We will evaluate reported security issues based on the security impact to our users and the Binance ecosystem. This bounty brief describes the rules of the Binance bug bounty program, as well as the eligibility of vulnerabilities and the rewards. Rewards/Ratings: This program takes reference from the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. Prioritization/ratings may vary from the Bugcrowd Vulnerability Rating Taxonomy. Rewards will be paid out in BNB . Once your submission is accepted, please provide either of the following to receive your reward. email address registered on Binance your BNB (BSC) wallet address We suggest researchers create a separate private Binance account, or a Binance Smart Chain wallet. *Prices will change with the cryptocurrency markets and the dollar amount listed below could change. Please note that only vulnerabilities with a working proof of concept that shows how it can be exploited will be considered eligible for monetary rewards. Determination of whether a reported issue sufficiently meets the bar for monetary rewards is done at Binance's discretion. *Binance is eager to work with the community to make sure that every researcher's finding is rewarded fairly - based on the vulnerability's impact on business and overall severity. To this end, it is possible that extraordinarily severe issues or those with extreme impact may be rewarded up to $100,000. Binance may award an additional reward bonus for exceptional reports. This will be done at Binance's discretion .

Targets

Any domain/property of Binance not listed in the targets section is out of scope. Target Information: Binance Primary Targets - Eligible for bounty from P4 and above *.binance.com (with exceptions, refer to Secondary Targets) api.binance.com binance.us Binance Mobile Application for Android Binance Mobile Application for iOS Binance Desktop Application Binance macOS Application Binance Connect binance.tr binance.th Secondary Targets - Eligible for bounty for P1 and P2. P3 and P4 will be points only academy.binance.com info.binance.com coinmarketcap.com api.coinmarketcap.com pro-api.coinmarketcap.com pro.coinmarketcap.com portal-api.coinmarketcap.com 3rdparty-apis.coinmarketcap.com CoinMarketCap Android app CoinMarketCap iOS app For Bugs Affecting Multiple Binance Exchanges If an issue reported for one of our exchanges (e.g. binance.com) affects any of our other exchanges, and shares the same root cause, it will be treated as a single issue. Please do not report the same exact bug multiple times. Access: Researchers are encouraged to self-provision accounts as needed; when doing so, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Trustwallet Vulnerability Classifications In scope: Trustwallet Android app Trustwallet iOS app Trustwallet walletcore Trustwallet Chrome Extension Out of scope: *.trustwallet.com *.trustwalletapp.com Examples of issues that we are looking for: Vulnerabilities that can cause a loss of user funds/assets remotely Vulnerabilities that can cause exposure of private keys or mnemonic seed phrase remotely Vulnerabilities in chain-related implementations Denial of service of the wallet app Remote code execution Insecure cryptographic implementation for sensitive functions such as wallet generation, transaction signing etc. Lock screen bypass Ineligible issues: Vulnerabilities that require root/jailbreak to exploit (points only if a change is made) 3rd party library dependencies Address bar spoofing in dapp browser Web vulnerabilities for *.trustwallet.com and *.trustwalletapp.com Issues related to TWT referral Actions to avoid: Testing on accounts other than those that you own Automated testing using tools such as scanners Excessive request attempts that affects the availability of our services to all users Destruction of data Ineligible issues (Will be closed as out of scope): Theoretical vulnerabilities without actual proof of concept Email verification deficiencies, expiration of password reset links, and password complexity policies Invalid or missing SPF (Sender Policy Framework) records (incomplete or missing SPF/DKIM/DMARC) Clickjacking/UI redressing with minimal security impact Email or mobile enumeration (E.g. the ability to identify emails via password reset) Information disclosure with minimal security impact (E.g. stack traces, path disclosure, directory listings, logs) Internally known issues, duplicate issues, or issues which have already been made public Tab-nabbing Self-XSS Vulnerabilities only exploitable on out-of-date browsers or platforms Vulnerabilities related to auto-fill web forms Use of known vulnerable libraries without actual proof of concept Lack of security flags in cookies Issues related to unsafe SSL/TLS cipher suites or protocol version Content spoofing Cache-control related issues Exposure of internal IP address or domains Missing security headers that do not lead to direct exploitation CSRF with negligible security impact (E.g. adding to favourites, adding to cart, subscribing to a non critical feature) Vulnerabilities that require root/jailbreak Vulnerabilities that require physical access to a user's device Issues that have no security impact (E.g. Failure to load a web page) Assets that do not belong to Binance Any activity (like DoS/DDoS) that disrupts our services Installation Path Permissions Reports from automated tools or scans Links to invalid/expired pages (Only valid if you can demonstrate an actual takeover of an official Binance social media account linked to on every page, not just specific past announcements/blog posts) Social Engineering