Aptos is a next-generation Layer 1 blockchain. Aptos’ breakthrough technology and programming language, Move, are designed to evolve, improve performance and strengthen user safeguards.
The Aptos Foundation ("Aptos", "we", or "us") welcomes feedback from security researchers and the general public to help improve the security of the new Move on Aptos Beta Compiler, and, at its sole discretion, offers bounty rewards ("Rewards") for security reports that identify previously unknown, in-scope security vulnerabilities. Aptos Foundation retains sole discretion to determine the amount of any Reward.
Target | Type | Severity | Reward |
---|---|---|---|
https://github.com/aptos-labs/aptos-core/tree/main/third_party/move/move-compiler-v2 | Code | Critical | Bounty |
As part of this limited program we want to reward security researchers capable of identifying correctness issues with the new Move on Aptos Beta Compiler. We welcome reports demonstrating that a single Move unit test produces different execution results when compiled with the current and the Move on Aptos Beta Compiler. Security reports that meet these requirements will be eligible for a reward up to $10,000.
Verification of different results should be reproducible by running the Move unit test with the aptos move test
command, with and without the -compiler-version=2
flag, where the test fails with one compiler version but not with the other. Multiple test-cases sharing the same root cause will be considered as a single report.
Other non-critical behavior inconsistencies between the old and the new compiler are out of scope from this program. These include test cases that:
To be eligible for a Reward, you are required to:
Rewards for duplicate security reports will be split among reporters with first to report taking priority using the following equation:
R: total reports
ri: report priority
bi: bounty share
bi = 2 ^ (R - ri) / ((2^R) - 1)
Where report priority derives from the set of integers beginning at 1, where the first reporter has ri = 1, the second reporter ri = 2, and so forth.
Note, reports that come in after the issue has been fully triaged and resolved will not be eligible for a Reward.
Do not discuss or disclose any vulnerabilities, even resolved ones, outside of this Program without the Aptos Foundation’s written consent.
You ARE NOT eligible to participate in the Program if you are:
To receive a Reward, you will have to enter into an Agreement with Aptos Foundation and provide required information, which may include identity verification information and tax information or forms, such as a W-9 or W-8 for U.S. residents or citizens.
Rewards are managed by Aptos Foundation and are denominated in United States Dollars (USD). Rewards may be paid partially or fully in digital assets at the sole discretion of Aptos Foundation. If you receive digital assets as part of your Reward, the value of the digital assets in USD will be determined at the time you execute your Agreement with Aptos Foundation and after you have satisfied all eligibility criteria. Token-based rewards may be subject to a lock-up period.