Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security-policy: Refer to SPL for on-chain programs #34697

Merged
merged 4 commits into from
Jan 9, 2024
Merged

security-policy: Refer to SPL for on-chain programs #34697

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2754e40
security-policy: Refer to SPL for on-chain programs
joncinque Jan 8, 2024
5fea536
Add SPL as a bullet point instead
joncinque Jan 8, 2024
eb28381
Remove reference to token
joncinque Jan 9, 2024
e938292
Add another bit about SPL at the top
joncinque Jan 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ Provide a helpful title, detailed description of the vulnerability and an exploi
proof-of-concept. Speculative submissions without proof-of-concept will be closed
with no further consideration.

Please refer to the
[Solana Program Library (SPL) security policy](https://github.com/solana-labs/solana-program-library/security/policy)
for vulnerabilities regarding SPL programs such as SPL Token.

If you haven't done so already, please **enable two-factor auth** in your GitHub account.

Expect a response as fast as possible in the advisory, typically within 72 hours.
Expand Down Expand Up @@ -98,7 +102,7 @@ mitigation to qualify.
#### Loss of Funds:
$2,000,000 USD in locked SOL tokens (locked for 12 months)
* Theft of funds without users signature from any account
* Theft of funds without users interaction in system, token, stake, vote programs
* Theft of funds without users interaction in system, stake, vote programs
* Theft of funds that requires users signature - creating a vote program that drains the delegated stakes.

#### Consensus/Safety Violations:
Expand Down Expand Up @@ -133,6 +137,8 @@ The following components are out of scope for the bounty program
* Any undeveloped automated tooling (scanners, etc) results. (OK with developed PoC)
* Any asset whose source code does not exist in this repository (including, but not limited
to, any and all web properties not explicitly listed on this page)
* Programs in the Solana Program Library, such as SPL Token. Please refer to the
[SPL security policy](https://github.com/solana-labs/solana-program-library/security/policy).

### Eligibility:
* Submissions _MUST_ include an exploit proof-of-concept to be considered eligible
Expand Down