Ethereum Foundation's Bug Bounty Program by Fredrik Svantes | Devcon Bogotá

foreign [Music] we have a lot of security researchers they spend all their time trying to break applications um and basically to figure out how the specifications of the protocol might be broken and then trying to sort that out we also take in some external bug hunters from time to time and they kind of focus on a specific task at hand and also to augment that we use a bug Bounty program so the bug bunny program is there in order to allow for external researchers to come in do some vulnerability [Music] bug hunting and then basically submit reports to the bug binding program and this is done so that we can provide rewards and other incentives to the bug Hunters so our scope is kind of wide we have you can see at least there um basically all the clients we have the deposit contract solid bugs and the specifications of the protocol but something that we don't have which is kind of unusual I guess is that we don't have any scope for websites or for infrastructure or if anything else we focus solely on the protocol itself you can use two different ways of having a bugabonnet program you can use bug body program as a service basically paying a service provider there are many of them they will come come in set up your back button program they will provide a often very very large set of bug Hunters that are ready to just start hammering on your application or you can do it in-house and there are some pros and cons for each but the um the reason we went for an in-house solution is that ethereum is kind of complex it requires a lot of expertise a lot of digging through it compared to let's say finding an SQL injection in a web application so we didn't feel that there was that much value so that's why I went with our in-house solution and we also have a team that can triage any reports that we're receiving but depending on your situation you might feel the need to go with a service provider so looking at the history we can see that in 2015 we launched the first iteration of the bug boundary program it had a very narrow scope um some execution layer clients and the rewards were 5 BTC for consensus issue which today would be quite a lot but back in the time it was 1500 bucks over the course of the years this was increased um and in 2020 the consensus layer bhagavani program was introduced at that time the execution layer had a bug Bounty of up to 25 000 and the consensus Larry received a Max Bounty of fifty thousand dollars we also have a specific thing where we will double the rewards during [Music] um basically just before hard Forks so this is done so that we will get additional eyes on any updates that we're doing to make sure that there aren't any obvious issues and then in 2022 we merged those programs into a single one we also up the rewards to 250 000 as the base Max reward and you can also get a 2X for a hard Fork but for the merge itself we increased it Forex so we had a 1 million Bounty out during the merge this is what it looked like um back in the days with the execution layer bug Bonnet program you can see the leaderboard there and basically you submitted reports via email you could use encryption if you wanted to but the majority didn't do that currently we have two ways we have the email system where you can submit a report or you can also use a Google form what kind of surprised me is that the vast majority of people they want to use a form to do it it's a bit easier to fill out because you have these kind of preset questions that you have to submit but there are some security concerns with that we shall get into soon so in the course of the bhagavani program we have received about yeah 200 plus vulnerabilities that were actual vulnerabilities counting the spam and non-vulnerabilities probably 2 000 reports but it's about 200 plus actual vulnerabilities and you can find these vulnerabilities in a public disclosure repo that we have on GitHub if you're interested in digging in a bit in what vulnerabilities yeah we've seen it's not completely updated we update it after each hard Fork so right now I think the latest update is in May or something like that March maybe but we will update it very soon again given that the merchants now happen so there will be additional ones to be found in this Repository uh oh and if you're interested in some specific vulnerabilities learning more about uh like in detail you can have a look at Mario's talk that he had I think two days ago um so like I said we're using the Google form system right now which isn't super good from a secured perspective because the reports we receive are plain text or clear text anyone can read them as long as they have access to the Google form system so if a user with access were to be compromised or Google forms were to be compromised then that would pose an issue especially now that we're dealing with vulnerabilities that could affect a lot of funds so we have been building a secure submission form which is based on openpgp.js and this allows basically bug Hunters to submit vulnerabilities and before they're submitted the the data is encrypted on client side so and this means that even if someone gains access to an email account or something else then they are basically um they can't read anything unless they have the private key that one is not real yet available publicly but we do have a smaller version available that people can download if they're interested in it which is the secure drop looking ahead um we're working on building an encrypted vulnerability lifecycle system this will allow us to basically follow the vulnerability from start to end we will be able to receive the runnability assign it to certain people have comments assign it to client teams and then close it as needed all while being encrypted and we're also looking at additional incentives for bounty hunters one of them that we've been looking at is basically creating bug hunting nfts that will provide some value in real life at events Etc and remix team has been doing something similar so that's it for me thank you very much for presenting me stop