VeChainThor

Bug bounty Triaged by HackenProof VeChainThor: Program info VeChainThor Company: VeChain Scope Review: 437042 Submissions: 622 Total rewards: $46,957 Reputation 100 points required PoC Required Submission fee $1 Program is: active now Live Submit report Program info Hackers 227 Reports 0 Cybersecurity of the company and the security of our users' data is a top priority for us, therefore VeChain launched a bug bounty program to find vulnerabilities and pay rewards. All Scope Focus Area Program Rules Disclosure Guidelines Scope Search targets In scope Target │ Type │ Severity https://github.com/vechain/thor Copy Protocol │ Critical Focus Area Scope This Bug Bounty ONLY limits to the code . Do code review for logical and security mistake in our testnet: VeChainThor is a new public blockchain that was written from scratch by the VeChain team. VeChainThor leveraged some of the features of Ethereum such as EVM. The VeChain team has added a lot enterprise friendly features at the core blockchain level so that it could be easily used by any developer or user on the platform. Some of the major features are: VET / VTHO dual token system, only VTHO will be consumed by the payment and smart contract execution Multi-party payment protocol Completely new transaction model Proof of Authority consensus Follow the updates via a special tab in the program, if you have any further questions feel free to ask via online chat on the site. Installation Thor is VeChain's new generation blockchain project. It's the official implementation written in golang. Download mainnet source code, vendor dependency packages and VeChain Thor Tutorial via Github https://github.com/vechain/thor. Connect to the testnet, generate wallet address by yourself and receive test tokens via faucet. What to look for Protocol and Network Conceptual and practical security issues in the formal specification of the protocol. Misaligned / unintended economic incentives and game theoretic flaws. Security weaknesses / attacks on the P2P communication protocol and PoA consensus algorithm. Attacks Scenarios for DoS attacks. 51% and other X% attacks Finney attacks Sybil attacks Replay attacks etc Transaction / messages malleability Server configuration issues (open ports) Node function validation Lack of validations of blocks, transactions and messages Transaction Block Chain Ethereum Virtual Machine code execution such as built-in contract, native function Contract creation Message calls Calculation and enforcement of fees. Client application security, suggestions on the APIs Data type overflow / wrap around, e.g. integer overflow. Panics or not properly handled errors. Concurrency, e.g. synchronization, state, races attacks. Issues related to external libraries used (outdated software). Cryptographic primitives security Incorrect implementation / usage / configuration of: Elliptic curve (secp256k1, ECDSA,ECDH,ECIES). Hash algorithms (Keccak-256,Blake2b). Merkle Patricia trees. Program Rules Only first submitted issue is eligible for bounty reward. In case you find chain vulnerabilities we pay only for vulnerability with the highest severity. Don’t violate any law and stay in the defined scope. You also must not disrupt any service, or compromise personal data. Follow disclosure guidelines. Disclosure Guidelines To participate in the contest, you must agree and follow the rules described in this policy. You must be the first to report a vulnerability to receive a reward. You must send a clear textual description of the work done, along with steps to reproduce the vulnerability. After sending report, you cannot tell anyone or anywhere. Public disclosure of a vulnerability makes it ineligible for a bounty. Also, please do not store screenshots and / or executable codes and scripts related to the vulnerability discovered on publicly available services and resources so that the information is not available to third parties. Live since 20 May 2018 Published date 20 May 2018 Last updated 24 Sep 2026 Range of bounty $1,000 - $35,000 Severity Critical $20,000 - $35,000 High $8,000 - $12,000 Medium $5,000 Low $1,000 L1/L2 blockchain Go @Artorias KYC Verified 1 gl @glg 2 @sahuang KYC Verified 3 @shaul KYC Verified 4 @TriageTeam 5 Response type Business days First Response 1d Triage Time 3d Reward Time 3d Resolution Time 5d