Move on Aptos Compiler: Program info

As part of this limited program we want to reward security researchers capable of identifying correctness issues with the new Move on Aptos Compiler. We welcome reports demonstrating that a single Move unit test produces different execution results when compiled with the legacy and the current Move on Aptos Compiler. Security reports that meet these requirements will be eligible for a reward up to $10,000.

Verification of different results should be reproducible by running the Move unit test with the aptos move test --move-1 and aptos move test --move-2 command, where the test fails with one compiler version but not with the other. Multiple test-cases sharing the same root cause will be considered as a single report. The test cases cannot contain Move 2 only features.

Other non-critical behavior inconsistencies between the old and the new compiler are out of scope from this program. These include test cases that:

• Generate different or no error messages or warnings between compiler versions;
• Compile only on one or the other compiler version, but not both;
• Require non-standard environment variables or configuration to reproduce the issue;
• Produce a bytecode that the bytecode verifier detects as invalid; or
• Incur in different gas charges.

To be eligible for a Reward, you are required to:

• Play by the rules, including following these Rules and any other relevant agreements. If there is any inconsistency or conflict between these Rules and any other applicable terms, the applicable terms of these Rules will prevail;
• Submit an in-scope vulnerability as detailed above;
• Include detailed information and clear steps to reproduce the issue. Vulnerabilities must be reproducible using the code currently in scope for the Program;
• Avoid any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet;
• Report any vulnerability within 24 hours from discovery;
• Avoid disrupting our systems, destroying data, and/or harming users;
• Only use this platform to report and discuss vulnerability information with us;
• Provide us a reasonable amount of time to resolve the issue;
• Limit the data you access to the minimum required to effectively demonstrate a Proof of Concept in circumstances where a vulnerability provides unintended access to private data or secrets;
• Vulnerabilities based on social engineering or network Denial of Service (DoS) attacks are considered out of scope and are not eligible for Rewards under this program;
• Not engage in extortion.

Duplicate Reports

Rewards for duplicate security reports will be split among reporters with first to report taking priority using the following equation:

R: total reports
ri: report priority
bi: bounty share

bi = 2 ^ (R - ri) / ((2^R) - 1)

Where report priority derives from the set of integers beginning at 1, where the first reporter has ri = 1, the second reporter ri = 2, and so forth.

Note, reports that come in after the issue has been fully triaged and resolved will not be eligible for a Reward.

Do not discuss or disclose any vulnerabilities, even resolved ones, outside of this Program without the Aptos Foundation’s written consent.

You ARE NOT eligible to participate in the Program if you are:

• A “Restricted Person” as defined in the Aptos Foundation Terms of Use. To receive a Bounty, you will be required to complete an identity verification process to confirm that you are not a Restricted Person.
• Under the age of 16. If you are at least 16 years old but are considered a minor in your place of residence, you must obtain your parent's or legal guardian's permission prior to participating in this Program.
• Currently an employee or provide services to the Aptos Foundation or are a former employee or provided services to the Aptos Foundation within the last 12 months of your submitted security report.
• Employed by an entity that does not allow you to participate in the Program.

To receive a Reward, you will have to enter into an Agreement with Aptos Foundation and provide required information, which may include identity verification information and tax information or forms, such as a W-9 or W-8 for U.S. residents or citizens.

Rewards are managed by Aptos Foundation and are denominated in United States Dollars (USD). Rewards may be paid partially or fully in digital assets at the sole discretion of Aptos Foundation. If you receive digital assets as part of your Reward, the value of the digital assets in USD will be determined at the time you execute your Agreement with Aptos Foundation and after you have satisfied all eligibility criteria. Token-based rewards may be subject to a lock-up period.