Development Bounty Program Rules

We have mad respect for your hacking skills and expect that you'll demonstrate them with integrity.

• Public disclosure of a vulnerability makes it ineligible for a bounty.
• Hunters must provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Hunters must only submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicate bugs/vulnerabilities are reported, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is strictly prohibited and if discovered will result in a permanent ban from the program and commensurate legal action.
• Hunters must make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
• Hunting and resolution exploration should only be performed on the bitcoinR testnet.
• Under NO circumstance should a hunter or user attempt to carry out DDoS attacks, leverage black hat techniques, spam people, or take any other similarly questionable paths to vulnerability hunting.
• We also discourage the use of any vulnerability testing tools that automatically generate very significant volumes of traffic on the bitcoinR mainnet.
• bitcoinR’s core development team, employees and all other people paid by bitcoinR, directly or indirectly, are not eligible for rewards.
• Anyone who works with the codebase as a professional bitcoinR developer is not eligible for a reward.
• bitcoinR websites or infrastructure in general, are NOT part of the bounty program.

Important Legal Information

The bitcoinR development bounty program is an experimental and discretionary rewards program for our active bitcoinR community to encourage and reward those who are helping to improve the platform.  You should know that we can cancel the program at any time, and rewards are at the sole discretion of the bitcoinR team. 

In addition, we are not able to issue rewards to individuals who are on sanctions lists or who are in countries on sanctions lists (e.g. North Korea, Iran, etc).  You are responsible for all taxes.  All rewards are subject to applicable law. 

Finally, your testing must not violate any law or compromise any data that is not yours.

Qualifying Vulnerabilities

Like that horrific spider or appalling cockroach, these are the bugs we're looking to squash.

We are looking to find issues affecting the stability or security of our blockchain protocol, mining client and wallet. 

• Bugs in our implementation of the cryptographic primitives
• Remote Code Execution
• Theft (unauthorized movement of funds, access to private keys)
• Inflation (creation of coins by any method different from mining or minting)
• Netsplit (preventing a part of the peer-to-peer network from communicating with the other part of the network in a way that could be applied generically)
• Denial of Service:
  • Creation of an invalid blockchain state
  • Ability to overload the whole network
  • Ability to overload a single client
  • Ability to crash a client
  • Ability to stall a client
  • Ability to disconnect a client
  • Ability to create an invalid client state
• A transaction's use of a large amount of memory (more than 1 MB)
• Ability to trigger unauthorized actions on an account

* For scenarios that do not fall within one of the above categories, bitcoinR still appreciates reports that help us secure our infrastructure for our customers.  As such, we will reward those reports based upon our own discretion and the evolution of our XBR Development Bounty Hunter program.

Non-Qualifying Vulnerabilities

Turn a blind eye or mercifully scoot them out the door; these bugs don't count.

Since our main interest is in finding security problems affecting our blockchain protocol and its implementation, the following issues are considered out of scope:

• Privacy related vulnerabilities (e.g. leaking your address to other peers on the network).
• Attacks requiring Man-In-The-Middle (MITM) or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Any activity that could lead to the disruption of our service (DoS), outside of the testnet.
• 51% attacks, including those on the testnet (duh, WTF?).
• Any problem on the servers where the nodes for the private testnet are running that is unrelated to our specific software (i.e. only the official client, blockchain and wallet are in scope).
• Any issues already reported publicly on GitHub.
• URL redirection or Phishing:  We recognize that the address bar is the only reliable security indicator in modern browsers; consequently, we maintain that the usability and security benefits of a small number of well­-designed and closely monitored redirectors outweigh their true risks.
• Flaws affecting the users of out ­of­ date systems. The security model of the web and blockchain is being constantly fine­-tuned.  bitcoinR will typically not reward any problems that affect only the users of outdated or unpatched systems.
• Clickjacking on pages with no sensitive actions or information.
• Unauthenticated/logout/login CSRF.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.

Reporting Bugs & Vulnerabilities

Here's what we want to know about the creepy crawlies you find.

If you have found a vulnerability, please submit a report using the Report a Bug button below. Note that we are only able to answer to technical vulnerability reports.  Please include the following in your report:

• The Asset - What software asset the vulnerability is related to (e.g. client, wallet, blockchain)
• The Severity - Your opinion on the severity of the issue (e.g. high, moderate, low)
• A Summary - ­A summary of the vulnerability
• A Description -­ Any additional details about this vulnerability
• Steps - Steps to reproduce
• Supporting Material/References ­- Source code to replicate, list any additional material (e.g. screenshots, logs, etc.)
• Impact - What security impact could an attacker achieve?
• Your name and country

Please be available to cooperate with the bitcoinR engineering team to provide further information on the bug if needed.

Additionally, please note that unidentified report submitters will not be eligible for the bounty payment.  Please expect to be asked for additional identification details for us to be able to progress with the payment.  Please submit your report as soon as you have discovered a potential security issue.  bitcoinR will consider the maximum impact and will choose the reward accordingly.  We may pay higher rewards for otherwise well-written and useful submissions where the reporter didn't notice or couldn't fully analyze the impact of a particular flaw.  Please note you will qualify for a reward only if you were the first person to alert us to a previously unknown flaw.  We will update you on the progress of your report ­ when it is accepted, validated, fixed and when the bounty is repaid.

Roadmap Improvements

Helping us navigate the curves and switchbacks can be profitable for you.

Here are a few categorical examples of areas where we will need some help:

• The Algorithms - Suggest ways we can reduce runtimes, improve memory burden, increase ASIC resistance.
• Protocol Security - If you see a crack in the dam say something, help us identify flaws in the protocols and get ahead of potential leaks.
• The Client - ­We try hard to avoid feature bloat, but if there is critical functionality missing, speak up.  We want to build what you need.
• The Wallet -­ There are several flavors of crypto wallets and we want ours to evolve to include the most desirable, elegant features.
• The Architecture - Like our bodies, without a strong backbone to support us none of the other stuff works properly, help us strengthen it.
• The Infrastructure ­- The storage, processing and communication mechanisms we choose should be the most efficient combination available.

Check this page on the first day of each calendar quarter (1-JAN, 1-APR, 1-JUN, 1-SEPT) for Roadmap Bounty postings!

Bounty Rewards

Reward sizes are guided by the rules below, but are in the end, determined at the sole discretion of the bitcoinR team.

Development Bounty sizes:
 

• Critical Impact: up to 100 XBR
• High Impact: up to 10 XBR
• Medium Impact: up to 5 XBR
• Low Impact: up to 2 XBR
• Note: up to 1 XBR

It is possible to triple the reward for a bug that you discover by providing a solution and successfully proving said solution on the bitcoinR testnet.

The bitcoinR team also considers the following factors when calculating bounty rewards for successful development submissions:
 

• Quality of description: Higher rewards are paid for clear, well-written documentation that accompanies the fix.
• Quality of reproducibility: Please include test code, scripts and detailed instructions.  The easier it is for us to reproduce and verify the vulnerability, the higher the reward.
• Quality of fix (if applicable): Higher rewards are paid for submissions with clear descriptions of how to fix the issue.

Media Bounty Program Rules

No one is tryna upset the Reddit Hive Mind.  So, uh, could you please check in with us before you do stuff?
 

• First rule of the road: if you want to be eligible for a media bounty, pitch us the idea FIRST.  
• We will review the finished product and approve it PRIOR to publishing, this will be a binary decision: APPROVED or DECLINED.
• We do not expect 100% of each media piece to be positive, it is okay to respectfully disagree with our decisions and/or suggest improvements.
• If you are making a promotional video or writing a promotional story and you own XBR currency units or shares of Digital Goals, Inc. please disclose your ownership position.
• We believe in freedom of the press.  If you are not looking for a bounty reward, and you have something important to say, please contact us and we'll endeavor to provide you with the information or access you might need to write your unbiased story.  Know that we are trying hard to develop something wonderful, and we will make a few mistakes along the way.  We acknowledge these imperfections up front and ask that you allow us to tell our side of the story.  This may go a long way to making our family holiday conversations less awkward.

Important Legal Information

The bitcoinR media bounty program is an experimental and discretionary rewards program for our active bitcoinR community to encourage and reward those who are helping to proliferate the platform.  You should know that we can cancel the program at any time, and rewards are at the sole discretion of the bitcoinR team. 

In addition, we are not able to issue rewards to individuals who are on sanctions lists or who are residents of or located in countries on U.S. sanctions lists (e.g. North Korea, Iran, etc.).  You are responsible for all taxes.  All rewards are subject to applicable law. 

Finally, your activity must not violate any law or plagiarize any content that may be protected.

Endorsements

Hey gorgeous!  Is that 50,000 followers in your pocket or are you just happy to see us?
 

If you or one of your entertainment clients is a crypto enthusiast and have an established fan base who hangs on your every Tweet, we'd love to have you as part of our VIP endorsement program.

What we look for in our partnership candidates:

• Engaged Audience:  An engaged, enthusiastic community is an invaluable asset to increasing exposure and fostering genuine interest in bitcoinR.
• Campaign Experience:  It's important that you have experience in speaking engagements, print campaigns, pictorial statements and have some media training.

If you're interested in partnering with us to grow our community please send us:

• Your name and contact information & that of your client (if applicable)
• Social media links and any personally branded websites, blogs or podcasts
• A proposal for a preferred type of endorsement campaign such as a podcast guest, speaking events, Tweets, etc.)

Events

Everyone loves a good mixer, but there are a few other places we'd roll with you to also.

Here are some of the events that we actively participate in and would eventually like to host:

• Hackathons:  Are you interested in hosting a bitcoinR hackathon?  We think these are excellent opportunities to not only educate the community about what we're doing, but we also like to network with other talented developers and professionals in the space.
• Meetups:  We'd love to be a featured guest at your blockchain Meetup, or we could sponsor a bitcoinR meetup in your city.  (Yeah, we'll send you t-shirts.  Yes.  Cool ones.)
• Conferences:  The bitcoinR team is eager to participate as keynote speakers or panelists at your conference to assist in further evangelizing blockchain technology.  (We promise not to talk about XBR the whole time.)

Podcasts

We encourage  hosts of successful podcasts to grill us about the blockchain ecosystem on their own channels.  If any or all of these apply, hit us up.  We're very interested in guest hosting an episode with you:

• Is your show considered to be controversial?
• Do you have a wide variety of listeners in multiple countries from assorted backgrounds?
• If you don't have the top ratings in your category, how can we help you get there?
• Do you have an established community on other social channels that you share your content through?

Print

Digital or wet ink.  We got your story right here.

We love to help filter out the noise and bring cutting-edge information to light.  Obviously, most publications do not solicit or accept payment for story placement, so this page is for PR agencies with tight connections into publications of note (digital or traditional) to get stories placed and interviews conducted.

Make sure to download our Media Kit to make your job a little easier.

Television

We point comfy furniture at this device too.

Nothing keeps us on the edge of our seat quite like an opportunity to learn something super cool.  Similar to print, broadcast television shows generally do not solicit or accept payment for story placement, so this page is for PR agencies with tight connections into broadcast shows of note (digital or traditional) to get bitcoinR stories placed and interviews conducted.

• Talk Show:  Do your talk show clients love a good conversational volley with capable tech entrepreneurs?
• News Channel:  Perhaps your client is an anchor for a local or national news station that is constantly on the lookout for groundbreaking topics to cover?

We'd love to be a part of the regularly scheduled programming.  

Social

There are endless corners of the Internet to spend your time in, but we think these are some of the best.

Our team has an expansive curiosity, but when it comes to cryptocurrency and blockchain there are a few communities that we all gravitate to for our news and discussions.  If your opinion carries weight in any of these places and you have a good crew of peeps that you run with online, we'd love to be a part of your network and discussions:

• YouTube:  Do you have a channel with 10,000 or more subscribers?  Want to give them a show they'll never forget?
• Reddit:  Do you moderate a cryptocurrency or blockchain-related subreddit and have really excellent karma?
• Quora:  Are you a "Top Writer" or a "most viewed writer" within well followed crypto topics on Quora?  Do you have 500+ followers?
• Twitter:  Do you have a highly engaged Twitter following of 10,000 or more that retweet you about digital currency regularly?
• Medium:  Do you curate your own well-followed crypto blog on Medium?
• Bitcoin Talk:  Are you a "Legendary" contributor or moderator on Bitcoin Talk?

If any of the these apply we'd love to chat about how we can work together.

Media Bounty Rewards

Reward sizes are guided by the rules below, but are in the end, determined at the sole discretion of the bitcoinR team.

Media Bounty sizes:
 

• 1,000,000+ verifiable views: up to 100 XBR
• 100,000 - 999,999 verifiable views: up to 10 XBR
• 50,000 - 99,999 verifiable views: up to 5 XBR
• 10,000 - 49,999 verifiable views: up to 2 XBR
• 1,000 - 9,999 verifiable views: 1 XBR

* Number of views are calculated as aggregate views (or audited physical distribution) up to 30 calendar days from the date of content publishing.

The bitcoinR team also considers the following factors when calculating bounty rewards for successful media submissions:
 

• Quality of production: Higher rewards are paid for clear, well-produced media.
• Extent of engagement: Are your followers commenting?  Asking great questions?  SHARING?  The virality of your post is important to us.