You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

71 lines
1.7 KiB

  1. # Security
  2. As part of our [Coordinated Vulnerability Disclosure
  3. Policy](https://tendermint.com/security), we operate a bug bounty.
  4. See the policy for more details on submissions and rewards.
  5. Here is a list of examples of the kinds of bugs we're most interested in:
  6. ## Specification
  7. - Conceptual flaws
  8. - Ambiguities, inconsistencies, or incorrect statements
  9. - Mis-match between specification and implementation of any component
  10. ## Consensus
  11. Assuming less than 1/3 of the voting power is Byzantine (malicious):
  12. - Validation of blockchain data structures, including blocks, block parts,
  13. votes, and so on
  14. - Execution of blocks
  15. - Validator set changes
  16. - Proposer round robin
  17. - Two nodes committing conflicting blocks for the same height (safety failure)
  18. - A correct node signing conflicting votes
  19. - A node halting (liveness failure)
  20. - Syncing new and old nodes
  21. ## Networking
  22. - Authenticated encryption (MITM, information leakage)
  23. - Eclipse attacks
  24. - Sybil attacks
  25. - Long-range attacks
  26. - Denial-of-Service
  27. ## RPC
  28. - Write-access to anything besides sending transactions
  29. - Denial-of-Service
  30. - Leakage of secrets
  31. ## Denial-of-Service
  32. Attacks may come through the P2P network or the RPC:
  33. - Amplification attacks
  34. - Resource abuse
  35. - Deadlocks and race conditions
  36. - Panics and unhandled errors
  37. ## Libraries
  38. - Serialization (Amino)
  39. - Reading/Writing files and databases
  40. - Logging and monitoring
  41. ## Cryptography
  42. - Elliptic curves for validator signatures
  43. - Hash algorithms and Merkle trees for block validation
  44. - Authenticated encryption for P2P connections
  45. ## Light Client
  46. - Validation of blockchain data structures
  47. - Correctly validating an incorrect proof
  48. - Incorrectly validating a correct proof
  49. - Syncing validator set changes