Cointime

Cointime

Download App
iOS & Android

Uniswap Launches Bug Bounty Program, Reward Up to 3 Million USDC

Overview

The security of Uniswap and its smart contracts are of utmost importance to us. For that reason we have an official Uniswap Bug Bounty (the ”Program”) to incentivize responsible bug disclosure. Rewards will be allocated based on the severity of the bug disclosed and evaluated for rewards up to 2,250,000 USDC.

Special Notice

Until Nov 30, 2022, all bugs found within Universal Router as well as Permit2 before they are launched will receive an additional bounty on top of the reward up to a maximum of 3,000,000 USDC.The scope of this additional bounty includes the following:

Scope

The Program includes vulnerabilities and bugs in any deployed Uniswap contract. These include those within the following GitHub repositories:- Universal Router Contract Code- Permit2 Contract Code- V3 Contract CodeHowever if you find a bug in a Uniswap smart contract outside of these repositories, where user funds are at risk, the team will consider the issue to be in-scope for our bounty.The following are not within the scope of the Program:

Rewards

The Program includes the following 4 level severity scale:

  • - Critical Issues that could impact numerous users and have serious reputational, legal or financial implications. An example would be being able to lock contracts permanently or take funds from all users.
  • - High Issues that impact individual users where exploitation would pose reputational, legal or moderate financial risk to the user.
  • - Medium The risk is relatively small and does not pose a threat to user funds.
  • - Low/Informational The issue does not pose an immediate risk but is relevant to security best practices.

Rewards will be given based on the above severity as well as the likelihood of the bug being triggered or exploited, to be determined at the sole discretion of Uniswap Labs. You can find out more about this scale at the OWASP risk rating methodology page.DisclosureAny vulnerability or bug discovered must be reported only to the following email: [email protected]. An acknowledgement of receipt will be given within 1 business day by Uniswap Labs.The vulnerability must not be disclosed publicly or to any other person, entity or email address before Uniswap Labs has been notified, has fixed the issue, and has granted permission for public disclosure. In addition, disclosure must be made within 24 hours following discovery of the vulnerability.A detailed report of a vulnerability increases the likelihood of a reward and may increase the reward amount. Please provide as much information about the vulnerability as possible, including:

  • - The conditions on which reproducing the bug is contingent.
  • - The steps needed to reproduce the bug or, preferably, a proof of concept.
  • - The potential implications of the vulnerability being abused.

Anyone who reports a unique, previously-unreported vulnerability that results in a change to the code or a configuration change and who keeps such vulnerability confidential until it has been resolved by our engineers will be recognized publicly for their contribution if they so choose.EligibilityTo be eligible for a reward under this Program, you must:

  • - Discover a previously-unreported, non-public vulnerability that is not previously known by the team and within the scope of this Program.
  • - Be the first to disclose the unique vulnerability to [email protected], in compliance with the disclosure requirements.
  • - Provide sufficient information to enable our engineers to reproduce and fix the vulnerability.
  • - Not exploit the vulnerability in any way, including through making it public or by obtaining a profit (other than a reward under this Program).
  • - Not publicize a vulnerability in any way, other than through private reporting to us.
  • - Make a good faith effort to avoid privacy violations, destruction of data, interruption or degradation of any of the assets in scope.
  • - Not submit a vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program.
  • - Not engage in any unlawful conduct when disclosing the bug to [email protected], including through threats, demands, or any other coercive tactics.
  • - Be at least 18 years of age or, if younger, submit your vulnerability with the consent of your parent or guardian.
  • - Not be subject to US sanctions or reside in a US-embargoed country.
  • - Not be one of our current or former employees, vendors, or contractors or an employee of any of those vendors or contractors.
  • - Comply with all the eligibility requirements of the Program.

Other Terms

By submitting your report, you grant Uniswap Labs any and all rights, including intellectual property rights, needed to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility for and amounts of the rewards and the manner in which such rewards will be paid, are made at our sole discretion.The terms and conditions of this Program may be altered at any time.

Comments

All Comments

Recommended for you

  • Cointime精选 ·

    State of Venus Q1 2024

    Venus (XVS) is a decentralized finance platform built on the BNB chain, offering a robust money market protocol for the crypto community. At its core, Venus enables users to deposit various cryptoassets, which can then be borrowed. Venus employs a unique algorithmic approach unlike traditional financial systems, where central entities often set interest rates. The interest rates for borrowing and lending on Venus are dynamically adjusted based on a jump rate model and whitepaper rate model. These models leverage the utilization ratio, which is the proportion of deposited assets that have been borrowed.

    State of Venus Q1 2024
  • Cointime精选 ·

    State of Aptos Q1 2024

    Aptos (APT) is a Layer-1 blockchain designed around the core tenets of scalability, safety, reliability, and upgradeability. Aptos was born out of Meta’s Diem and Novi projects, eventually launching in October 2022. Core developer Aptos Labs raised about $400 million in two 2022 private investor rounds.

    State of Aptos Q1 2024

  • Xinjiang launches special campaign to combat illegal fundraising, with key areas including virtual currency, blockchain, etc.

    According to Chang'an Xinjiang Public Account, Xinjiang Autonomous Region and Corps have launched a joint special action to crack down on illegal fund-raising, with key areas including third-party wealth management, fake private equity, fake gold exchange and other traditional fields, as well as emerging fields such as virtual currency, blockchain, cultural tourism, film and television investment, and debt resolution services. It is reported that key cases include cases involving more than 100 million yuan and cases that have been criminally filed for more than five years.

  • A British court has postponed the final sentencing of Wen Jian, a British-Chinese national involved in the country's largest Bitcoin money laundering case, until May 24.

    On May 11th, it was reported that Jian Wen, a 42-year-old British Chinese citizen, was found guilty of "participating in arranging money laundering" in the UK's largest Bitcoin money laundering case. He could be sentenced to up to 14 years in prison. Jian Wen's defense lawyer, Mark Harries, stated that due to the judge's busy schedule, the UK court has postponed Jian Wen's final sentencing, which was originally scheduled for May 10th, to May 24th.

  • Web3 startup Star Nest completes $6 million in Pre-A round of financing

    Hong Kong Web3 music startup Star Nest announced that it has completed a $6 million Pre-A round of financing, led by Chuangqi International Limited, a wholly-owned subsidiary of Hong Kong Stock Exchange-listed company Guofu Innovation. Star Nest will collaborate with Armonia Meta Chain to develop the Star Nest SpaceStar metaverse game, which includes music, role-playing, and social features.In addition, Star Nest plans to launch its NEST project in the third quarter of 2024. Nest will receive 2.1 billion NEST tokens tailored for the project, and Star Nest will use the NEST token to build a more complete music industry token economic system. The NEST token will be widely used for purchasing performance tickets, chain game cooperation, metaverse consumption, governance voting, and other activities.

  • Over $594 million worth of PYTH is staked

    According to Dune data,  there are currently 1,201,167,362 PYTH tokens in the staked state, with a total staked value exceeding $594 million. The number of PYTH stakers has reached 151,211.

  • US Department of Justice: Tornado Cash indictment has nothing to do with "free speech"

    On May 11th, the US Department of Justice explained why the motion to dismiss the criminal case against Tornado Cash founder Roman Storm was invalid. The Department of Justice reiterated that their indictment was not related to whether the Tornado Cash computer code had freedom of speech or was protected by the First Amendment of the Constitution. The defendant was not charged for publishing computer code, but for using it to facilitate profitable illegal activities.

  • USDC circulation decreased by $100 million in the past week, with a total circulation of $33 billion

    According to official data，as of May 9th, Circle has issued approximately $2 billion USDC and redeemed approximately $2 billion USDC in the past 7 days, with a decrease in circulation of approximately $100 million. The total circulation of USDC is $33 billion, with a reserve of $33.1 billion, including approximately $3.3 billion in cash and Circle Reserve Fund holding approximately $29.8 billion.

  • SEC rejects Coinbase's request for appeals court ruling on cryptocurrency rules

    The US SEC has rejected Coinbase's request to appeal to the court to review whether traditional securities rules are applicable to cryptocurrencies. In its application, Coinbase stated that it hoped the appeals court would consider whether the Howey test, which has long been used for securities evaluation, should be applied to digital assets. However, the SEC pointed out that Coinbase has not successfully demonstrated the need for such an evaluation. The SEC stated that Coinbase is attempting to create a "new legal test," but this attempt was rejected by the court. The court found that Coinbase's arguments lacked consistency and did not successfully demonstrate the existence of decisive issues. Currently, the judge responsible for hearing the SEC's case against Coinbase will make a ruling on Coinbase's intermediate appeal motion.

  • Colombian President Suspected of Accepting $500,000 in Illegal Crypto Donations

    Colombian President Gustavo Petro is suspected of accepting over $500,000 in digital token donations from a fraudulent cryptocurrency project during his 2022 election campaign. A former contractor revealed that the illegal donation occurred during a meeting in February 2022 that discussed the advantages of cryptocurrency and the possibility of working with the government. This allegation is one of the latest charges faced by President Petro during his election campaign, with the Colombian Prosecutor's Office investigating his campaign last year.

Daily Must-Read

Popular Activities

Delysium $AGI & AI Private Yacht Party

Delysium $AGI & AI Private Yacht Party

March 27 - March 27
Seoul

Popular Tags

Cointime
News
Contents
RSS
Company