Electroneum Smart Chain (ETN-SC) — EVM-Compatible Blockchain

Description

Program Overview Electroneum invites the security research community to test and help secure the Electroneum Smart Chain (ETN-SC), a next-generation EVM-compatible Layer 1 blockchain built for speed, scalability, and real-world utility. ETN-SC is designed to power the future of digital payments and decentralized applications. It leverages the Istanbul Byzantine Fault Tolerant (IBFT) consensus mechanism for instant finality and high throughput, while maintaining full compatibility with Ethereum tooling and smart contracts. This bounty program focuses on identifying vulnerabilities across the ETN-SC ecosystem. This includes the core blockchain protocol, RPC endpoints, smart contract deployment, validator operations, governance mechanisms, and the official block explorer. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Program Rules When conducting blockchain research, please do not enact any discovered exploits in order to create a POC, for example, minting new tokens, moving users balances around or otherwise affect our user’s ability to conduct their usual operations on the blockchain and maintain their wallet balances. This program relates to our production environments, behaviour that compromises the stability and integrity of the site is out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage in any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it. Please read thoroughly the code relevant to your submission before making submissions, ensuring that the vulnerability is realistic and relates to production code or scenarios. Also please do not relay proof of concepts found with AI tools without reviewing them yourself first. Testing is only authorized on the targets listed as in scope. Any domain/property of Electroneum not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Electroneum, you can report it to this engagement, and is appreciated. However, be aware that it is ineligible for rewards or points-based compensation. Creating reports for the Smartchain Blockchain Our Smart chain Blockchain codebase ( https://github.com/electroneum/electroneum-sc/ ), which contains the smart blockchain code and the code for the accompanying suite of utility programs (the blockchain client/daemon, the RPC wallet client, the command line wallet and tools for importing and exporting the blockchain). Please understand that the old legacy blockchain ( https://github.com/electroneum/electroneum ) is NOT covered under this Bugcrowd program, there is a separate program for this part of the project. Eligible Submission Types The only vulnerability or bug submissions that will be unequivocally triaged according to the Bugcrowd taxonomy and paid out will be ones that are able to probably generate one of the following outcomes: A) Minting of new tokens or burning of tokens through a currently unknown mechanism. B) Gaming the consensus algorithm in order to gain monetary advantage or completely shut down the network or significantly affect the regularity of blocks being published to the main chain. C) Stealing other’s tokens or revealing their wallet private keys. D) Changing the blockchain data of the past and having the network accept these changes. E) Any vulnerability that allows an attacker to trick an exchange or other third party about the reality of information pertaining to transactions or blocks, by way of altering how this information is displayed in a wallet or the blockchain explorer. Researchers need to explain the impact according to this list mentioned above. If you have found what you believe to be a highly serious exploit that is not covered by one of these categories of outcome, please still reach out to us, as we may nonetheless award you a payout at our discretion if we believe that the vulnerability is significant enough, in that it poses a threat of a magnitude comparable to those outlined in the above categories. Excluded Submission Types When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are excluded from this engagement: P5 vulnerabilities Non-security impacting UX issues. Deprecated Third Party Open-Source libraries are not in scope. For our own supported and actively maintained open-source libraries, we accept vulnerability reports through Bugcrowd. Vulnerabilities or weaknesses in third party applications that integrate with Electroneum. Vulnerabilities associated with creating an emulator for the mining environment that do not demonstrate the ability to dramatically increase mining function or show other security impact. Clickjacking on pages with no sensitive actions. Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Any type of injection without demonstrating a vulnerability. Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Password complexity-related issues Rate limiting related issues. N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Out of Scope The following are considered out of scope unless a clear and demonstrable impact on network security, consensus integrity, or user funds is shown: Theoretical vulnerabilities without a working proof-of-concept or real-world exploitability Attacks requiring unrealistic validator collusion or assumptions that break the trust model without technical execution Crashes or panics in development or debug builds that do not affect production deployments Compiler crashes (e.g., Solidity or Vyper) caused by malformed or intentionally corrupted input Smart contract vulnerabilities in unaudited or third-party contracts not deployed or maintained by Electroneum Attacks requiring full control over the network or unrealistic network conditions (e.g., eclipse attacks without a feasible setup) Consensus splits caused by non-standard forks or unsupported client versions Known issues already documented in the GitHub repository or public roadmap Bug reports based solely on fixes already publicly committed to Ethereum or other upstream blockchains Third-party services, infrastructure, or dependencies not maintained by Electroneum and not part of the blockchain scope DoS attacks that do not impact consensus, validator liveness, or user funds Social engineering, phishing, or physical attacks We will not accept reports based on bugfixes that have already publicly been committed to Ethereum or any other EVM chain derived from Ethereum's codebase We will not accept submissions for which the issue is publicly well known and discussed upstream in the community of Ethereum or any Ethereum fork, despite not being fixed Important Notes for Researchers Your report must clearly explain how the vulnerability leads to one of the outcomes listed above. If your finding does not fall into these categories but you believe it poses a critical risk, please still submit it. We may award a bounty at our discretion if the issue is of comparable severity. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further. Other Related Programs Please also checkout our other Bug Bounty Programs: Electroneum Wallet: Gateway to the ETN Cryptocurrency Electroneum Legacy Blockchain: EOL AnyTask: Freelancer Platform