Entain Game Logic Flaws Bug Bounty Program

Description

Welcome to Entain's Game and Business Logic Flaw bug bounty program! We are Entain, an international sports betting and gambling company, and like our customers, we get excited about the world of sport, gaming and interactive entertainment. Whether it’s watching your favourite team, beating your mates or experiencing the next big thing, we love exciting moments. Just like hunting down your next big win in an 5 vs 5 team death match, you finding a flaw within our applications should bring some excitement to your and our lives. Good luck, and happy hunting! Please note the following: The targets on this engagement are for a sports betting and gambling company. Bugcrowd cannot be held liable if a Security Researcher breaches their country’s anti-gambling laws. Bugcrowd cannot give legal advice to any Security Researcher about their country’s laws or whether they should proceed with testing on the listed targets. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the following table as reference: Example vulnerabilities by priority level: Priority │ Example Vulnerability P1 │ Predict, influence the outcome of a game or perform a successful action against the rules of a game leading to a financial impact. P2 │ Ability to perform a free-spin on out of bounds bases, Modification of permitted amount of a free-spin. P3 │ Perform a successful action against the rules of a game not leading to a financial impact. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Entain not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Entain, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary compensation. Access: All of our games are publicly accessible across all our assets below. To create an account on these websites, you'll need to use a VPN from the UK or USA and provide an address from the corresponding country. To find those games, you will need to connect to the casino part of the asset in scope, search for the game, login to play. An account will be necessary for the researchers to be able to test the game. Credentials: Accounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: Game Logic Flaws This program focuses on Game and Business Logic Flaws. Meaning that we want so see if you are somehow able to use the in game logic to gain an unfair advantage over the game or other players. For example: Can you place a bet with a negative stake ? Can you play with insufficient funds in the account ? Can you circumvent a game to run against the defined game rules ? Can you predict outcomes of a game ? Knowledge Base: A Game Engine Map is available in the Resources tab on the program brief, and here . This map will allow you to see what games across all platforms are utilizing the same engine. Out-of-Scope Current employees, former employees, and any members of their immediate families are not eligible to participate in this Bug Bounty Program. The following submission types are excluded from our program: Anything that is not related to Game/Business Logic Flaws Any form of social engineering that is needed to achieve a flaw. Third party services Entain uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program. We cannot authorise security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of Entain's misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding. If you are unsure if a particular asset is in scope or sits with a third party within this program, please reach out to Bugcrowd Support Portal and we will help you out. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support and create a support ticket.

In Scope (in scope)

Find a Game to test on our targets: The process for finding and accessing a game is the same: connect to the casino section of the website, search for the game, and login to play. Only the games listed here: Entain-Casino-Games-Engine-List.pdf are in scope. The websites that host the games are NOT in scope for this bug bounty program. You will need to create an account in order to test the game. BetMGM USA sites To ensure a seamless user experience and comply with GeoIP restrictions, we kindly request that you visit our website at www.betmgm.com. Upon accessing the site, you will be directed to the appropriate state location or provided with a default option for your convenience. Please note that the URL may differ based on your specific location. For instance, if you are in New Jersey it will resolve to: https://casino.nj.betmgm.com/en/games