KuCoin Managed Bug Bounty Program

Description

No technology is perfect and KuCoin believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our applications. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Kucoin listed in the targets "out of scope" section is out of scope. Target Information: Please report vulnerabilities found on : Our main website https://kucoin.com Android and iOS apps, available via their respective app stores Access: Targets are accessible via the public internet. Credentials: All targets are self-sign up. Please sign up for an account using your @bugcrowdninja.com email address, and if you want access all product features , you need to pass KuCoin's KYC certification. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: Web Application Vulnerabilities Critical Remote Code Execution (RCE): Executing arbitrary code on Kucoin servers. SQL Injection (Core DB): Large-scale data access/modification in Kucoin’s core production database. Admin Backend Takeover: Gaining critical admin privileges. Mass Account Takeover: Systemic takeover of a large portion of user accounts, typically affecting >50% of users. System Command Execution: Running OS commands on critical servers. High Stored XSS Worms: Self-replicating cross-site scripting on critical user-facing pages. CSRF (Critical Actions): CSRF that leads to account compromise or unauthorized asset actions. Account Access at Scale: Unauthorized access to multiple user accounts due to flaws in authentication or authorization logic. SQL Injection (Limited): Extracting specific sensitive data. Source Code Leakage: Exposure of significant backend or internal source code. SSRF (Contextual Impact): SSRF that reaches internal services (SSRF severity is dependent on the impact of the internal access achieved.). Medium Stored XSS (Interaction): Persistent cross-site scripting requiring user interaction to trigger. CSRF (Core Business): CSRF targeting non-critical business actions. Auth Bypass (Limited): Unauthorized access to backend or user data without financial impact. Subdomain Takeover: Control of unused subdomains with reputational or phishing risk. Verification Code Flaws: Weaknesses in login or password reset verification logic. Sensitive Data Exposure: Disclosure of encrypted or internal user data through accessible interfaces. Cleartext Credentials: Hardcoded credentials in source code or configuration files, excluding API keys. Bypass of Authenticity Verification: Circumventing authenticity checks for mobile, email, and KYC verification, such as using AI-generated fake documents, modifying metadata of uploaded files to bypass verification, or evading liveness detection mechanisms. Low Reflected XSS: Non-persistent cross-site scripting in URLs or parameters. DOM/Flash XSS: Client-side cross-site scripting with no backend interaction. Open Redirects: Redirecting users to external domains without validation. General Info Leaks: Exposure of internal paths, directories, or debug interfaces. Common CSRF: CSRF targeting non-sensitive user actions. HTTP Header Manipulation: Modifying headers with low impact, such as cache behavior or redirects. Unlimited Bulk Registration: Capable of creating unlimited fake accounts while fully bypassing all anti-automation safeguards. Unlimited Campaign Reward Claiming: Exploiting vulnerabilities to claim activity rewards repeatedly, depleting the entire reward pool. Fabricated Participation: Forging campaign participation records or partially circumventing participation requirements. Sybil Attack: Coordinated participation in airdrops and referral commission campaign using bulk-registered accounts. Referral Abuse: Gaining improper rewards through technical manipulation including self-referral, puppet networks simulating genuine referral chains, and exploitation of referral relationships. Mobile Application Vulnerabilities Focus: Issues found in Kucoin official mobile apps and must be reproducible in the latest released version. Critical Contactless remote execution of arbitrary code. Contactless remote access to any application sandbox file. Local exploitation of Kucoin application vulnerability for unauthorized access to TEE protection keys and authentication information. High Exploiting vulnerabilities in the Kucoin application can remotely obtain sensitive user information (user credentials, mnemonic words, etc.). Remote execution of arbitrary code within the application process. Remote access to any application sandbox file. Remote exploitation of application vulnerabilities leads to permanent denial of service for the client, and the application needs to be uninstalled and installed to recover. Medium Start any non-exported component. Local exploit vulnerability to read arbitrary files in sandbox. Local execution of arbitrary code within the application process. Locally exploit vulnerabilities to obtain sensitive information related to users. Local exploitation of application vulnerabilities leads to permanent denial of service for the client, and the application needs to be uninstalled and installed to recover. Low Storing sensitive information in external storage. Exposing sensitive data through a logging system. Web3 Vulnerabilities Focus: Issues affecting Kucoin Web3 Wallet, blockchain infrastructure, or funds. Critical Criteria: Affects >50% of users, >15 min downtime, or >$100K potential loss. Remote exploits on validators/contracts or admin takeovers. High Criteria: Affects >30% of users, >10 min downtime, or >$50K potential loss. Validator issues, fund logic flaws, or code leaks. Medium Criteria: Requires interaction or limited scope. Interaction-based wallet exploits or transaction disruptions. Low Criteria: Minimal impact or exploitability. Node stability issues or minor leaks. Threat intelligence Critical A large amount of Kucoin user core data is available. Provide clues such as the industry chain formed by major 0 days and undisclosed vulnerabilities. The server has been hacked, and provide relevant financial clues such as the intrusion method and behavior. Related information that can have a significant impact on Kucoin. High Intelligence that significantly impacts Kucoin's core business, systems, and office networks Medium Relevant information that has a significant direct impact on specific business revenue, such as wool-pulling, etc. Low Information that has a minor impact on Kucoin's business, such as unavailability of business services, etc. N-Day Policy: When N-Day bugs are released to the public, we will consider them to be in scope after 14 days has passed. e.g: N-day released on 01/01/2024, we would consider it in-scope on 01/15/2024 OUT OF SCOPE – MOBILE VULNERABILITIES Attacks requiring physical access to a user's device Vulnerabilities that require root/jailbreak Vulnerabilities requiring extensive user interaction Exposure of non-sensitive data on the device Reports from static analysis of the binary without PoC that impacts business logic Lack of obfuscation/binary protection/root(jailbreak) detection Bypass certificate pinning on rooted devices Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries Sensitive data in URLs/request bodies when protected by TLS Path disclosure in binary OAuth & app secret hard-coded/recoverable in IPA, APK Sensitive information retained as plaintext in the device’s memory Crashes due to malformed URL Schemes or Intents sent to exported Activity/Service/Broadcast Receiver Any kind of sensitive data stored in-app private directory Runtime hacking exploits using tools like but not limited to Frida / Appmon (exploits only possible in a jailbroken environment) Shared links leaked through the system clipboard Any URIs leaked because a malicious app has permission to view URIs opened. Exposure of API keys with no security impact (Google Maps API keys etc.) Reports that bypass rate limiting through changing of IP addresses / Device IDs Address bar / URL / domain spoofing in dApp browser Reports with mobile versions not downloaded from official sites listed in our scope OUT OF SCOPE – WEB CLIENT VULNERABILITIES When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope: Reports from automated tools or scans False positive SQL Injection To avoid submitting a false positive, please ensure that you are able to provide a working PoC that demonstrates the ability to retrieve the current database / current user name Spam vulnerability, mail spoofing, mail bomb, etc Self-XSS Use of known-vulnerable library or component Clickjacking on pages with no sensitive actions Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions Attacks requiring MITM or physical access to a user's device Previously known vulnerable libraries without a working Proof of Concept Comma Separated Values (CSV) injection without demonstrating a vulnerability Missing best practices in SSL/TLS configuration Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Rate limiting or brute-force issues on non-authentication endpoints Missing best practices in Content Security Policy Missing HttpOnly or Secure flags on cookies Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) Vulnerabilities only affect users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version] Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors) Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis Tabnabbing Issues that require unlikely user interaction Vulnerabilities that are already known (e.g. discovered by an internal team) Best practice reports are not eligible for bounties but are appreciated Wordpress related vulnerability DLL hijacking reports that fail to demonstrate how they achieve elevated privileges. Reports that bypass rate limiting through changing of IP addresses / Device IDs Address bar / URL / domain spoofing in dApp browser Sensitive data exposure on social media accounts Reports with desktop client versions not downloaded from our official sites listed in our scope Proof of reserves being reported as "sensitive document" leak Sensitive information leak from web archive / wayback machine Broken link / social media account takeovers Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please visit Bugcrowd Support and create a support ticket before going any further.

In-Scope Business-related assets (in scope)

This is the main site where all applications are listed

In-Scope None-Business-related assets (in scope)

This is the main site where all applications are listed

In-Scope Mobile App Targets (in scope)

Kucoin App (Mobile App）