From 5a7b4811be9356e0bd60963119a4ccaafe26d850 Mon Sep 17 00:00:00 2001 From: cyberthirst Date: Tue, 10 Sep 2024 23:03:22 +0200 Subject: [PATCH] feat[docs]: add bug bounty program to security policy (#4230) --------- Co-authored-by: sudo rm -rf --no-preserve-root / --- SECURITY.md | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1a16f521d3..977a00f7b2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,7 +3,7 @@ ## Supported Versions - it is recommended to follow the list of known [vulnerabilities](https://github.com/vyperlang/vyper/security/advisories) and stay up-to-date with the latest releases - - as of May 2024, the `0.4.0` release is the most secure and the most comprehensively reviewed one and is recommended for use in production environments + - as of May 2024, the [`0.4.0`](https://github.com/vyperlang/vyper/releases/tag/v0.4.0) release is the most comprehensively reviewed one and is recommended for use in production environments - if a compiler vulnerability is found, a new compiler version with a patch will be released. The vulnerable version itself is not updated (see the examples below). - `example1`: suppose `0.4.0` is the latest version and a hypothetical vulnerability is found in `0.4.0`, then a patch will be released in `0.4.1` - `example2`: suppose `0.4.0` is the latest version and a hypothetical vulnerability is found both in `0.3.10` and `0.4.0`, then a patch will be released only in `0.4.1` @@ -26,7 +26,22 @@ we will add an entry to the list of security advisories for posterity and refere ## Bug Bounty Program -- as of May 2024, Vyper does not have a bug bounty program. It is planned to instantiate one soon. +- Vyper runs a bug bounty program via the Ethereum Foundation. + - Bugs should be reported through the [Ethereum Foundation's bounty program](https://ethereum.org/bug-bounty). + +### Scope +- Rules from the Ethereum Foundation's bug bounty program apply; for any questions please reach out [here](mailto:bounty@ethereum.org). Here we further clarify the scope of the Vyper bounty program. +- If a compiler bug affects production code, it is in scope (excluding known issues). + - This includes bugs in older compiler versions still used in production. +- If a compiler bug does not currently affect production but is likely to in the future, it is in scope. + - This mainly applies to the latest compiler release (e.g., a new release is available but contracts are not yet deployed with it). + - Experimental features (e.g. `--experimental-codegen`) are out of scope, as they are not intended for production and are unlikely to affect production code. + - Bugs in older compiler versions are generally out of scope, as they are no longer used for new contracts. + - There might be exceptions, e.g., when an L2 doesn't support recent compiler releases. In such cases, it might be reasonable for an older version to be used. It is up to the discretion of the EF & Vyper team to decide if the bug is in scope. +- If a vulnerability affects multiple contracts, the whitehat is eligible for only one payout (though the severity of the bug may increase). +- Eligibility for project-specific bounties is independent of this bounty. +- [Security advisories](https://github.com/vyperlang/vyper/security/advisories) and [known issues](https://github.com/vyperlang/vyper/issues) are not eligible for the bounty program, as they are publicly disclosed and protocols should structure their contracts accordingly. +- Individuals or organizations contracted or engaged specifically for security development, auditing, or testing of this project are ineligible for the bounty program. ## Reporting a Vulnerability