Exzo Network is an innovative blockchain platform that boasts exceptional features, including an innovative time architecture, efficient transaction processing, and a reliable consensus model. It is a full hybrid EVM/eBPF chain of Solana and Ethereum, offering enhanced security, scalability, and high performance, with 1.2 seconds of finality, extremely low transaction fees, and full EVM/Solidity support.
In Scope
| Target | Type | Severity | Reward |
|---|---|---|---|
https://github.com/ExzoNetwork/Exzo-Network-Blockchain |
Protocol | Critical | Bounty |
https://github.com/ExzoNetwork/exzo-network-web3.js |
Protocol | Critical | Bounty |
https://github.com/ExzoNetwork/Exzo-Network-account-sponsor |
Protocol | Critical | Bounty |
P4:
A vulnerability that could compromise the safety of any user's or validator's funds or fees.
Subversion of the DEX trading logic
A vulnerability that could severely undermine the token economy or trading.
Key generation, encryption, signing, and verification-related security vulnerabilities.
The malleability of transactions or spoofing of transaction origins.
Merkle proof vulnerability
Manipulation of blockchain validator
Remote code execution on any Exzo Network Chain
Vulnerabilities that could disrupt the Exzo Network’s blockchain
Vulnerabilities that could disrupt users staked or delegated funds towards node validators or while operating a node
Any vulnerabilities in smart contracts that could lead to loss of funds
P3:
Denial of service of any Exzo Network blockchain
Vulnerabilities that could disrupt Blockchain validator and its performances.
Vulnerabilities that cause Exzo Network to be unable to respond to users' queries on orders, transactions, balance etc.
Access to disable channels of cross-chain bridge.
Denial of service of cross-chain bridge.
P2:
Denial of service of any Exzo Network chain
P1:
Vulnerabilities that could affect Exzo Network related node on stability or availability.
Out-of-Scope Vulnerabilities
- Denial-of-Service, OOM, or panic on any API exposed by Exzo Network
- Network-level Denial-of-Service (TCP/IP/P2P)
- Misconfigurations of Exzo Network nodes currently running on the Exzo Network
- Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
- Make every effort not to damage or restrict the availability of products, services, or infrastructure
- Avoid compromising any personal data, interruption, or degradation of any service
- Don’t access or modify other user data, localize all tests to your accounts
- Perform testing only within the scope
- Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
- Don’t spam forms or account creation flows using automated scanners
- In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
- Don’t break any law and stay in the defined scope
- Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
- As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- No vulnerability disclosure, including partial, is allowed for the moment.
- Please do NOT publish/discuss bugs.
We are happy to thank everyone who submits valid reports, which help us improve security. However, only those who meet the following eligibility requirements may receive a monetary reward:
- You must be the first vulnerability reporter.
- The vulnerability must be a qualifying vulnerability
- Any vulnerability found must be reported no later than 24 hours after discovery, and exclusively through hackenproof.com
- You must send a clear textual description of the report along with steps to reproduce the issue, including attachments such as screenshots or proof of concept code as necessary.
- You must not be a former or current employee of ours or one of its contractors.
- ONLY USE YOUR HackerProof ACCOUNT (in case of violation, no bounty will be awarded)
- Provide detailed but to-the-point reproduction steps
REWARD LIST
High-quality reports may be awarded an extra bonus. A high-quality report is a thoroughly written vulnerability report that includes (when applicable) a working proof-of-concept, root cause analysis, a suggested fix, and any other relevant information.
KNOWN ISSUES
Please note that the Exzo Network Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.