OKX Blockchain Infrastructure : Program info

IN-SCOPE VULNERABILITIES

P4:

• A vulnerability that could compromise the safety of any user's or validator's funds or fees.
• Subversion of the DEX trading logic
• A vulnerability that could severely undermine the token economy or trading.
• Key generation, encryption, signing, and verification-related security vulnerabilities.
• The malleability of transactions or spoofing of transaction origins.
• Merkle proof vulnerability
• Manipulation of blockchain validator
• Remote code execution on any OKC Chain
• Vulnerabilities that could disrupt the OKC chain

P3:

• Denial of service of any OKC chain
• Vulnerabilities that could disrupt Blockchain validator and its performances.
• Vulnerabilities that cause OKX to be unable to respond to users' queries on orders, transactions, balance etc.
• Access to disable channels of cross-chain bridge.
• Denial of service of cross-chain bridge.

P2:

• Denial of service of any OKC chain

P1:

• Vulnerabilities that could affect OKC related node on stability or availability.

OUT-OF-SCOPE VULNERABILITIES

• everything from our OKX general program at HackenProof

• Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Don’t access or modify other user data, localize all tests to your accounts
• Perform testing only within the scope
• Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
• Don’t spam forms or account creation flows using automated scanners
• In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
• Don’t break any law and stay in the defined scope
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial, is allowed for the moment.
• Please do NOT publish/discuss bugs

We are happy to thank everyone who submits valid reports, which help us improve security. However, only those who meet the following eligibility requirements may receive a monetary reward:

• You must be the first vulnerability reporter.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery, and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, including attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of ours or one of its contractors.
• ONLY USE YOUR HackerProof ACCOUNT (in case of violation, no bounty will be awarded)
• Provide detailed but to-the-point reproduction steps

REWARD LIST

• High-quality reports may be awarded an extra bonus. A high-quality report is a thoroughly written vulnerability report that includes (when applicable) a working proof-of-concept, root cause analysis, a suggested fix, and any other relevant information.

KNOWN ISSUES

• Please note that the OKX Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.