Bug Bounty Program

Individuals or organizations who report and/or resolve bugs are eligible for rewards (EWT and public recognition) as follows:

• Bugs are categorized at the sole discretion of the Energy Web Technical Committee using a risk assessment matrix based on impact and likelihood. The reward for a given bug is proportional to its severity; rewards are also higher for reporting a bug along with a recommended resolution than for reporting a bug alone.
  
  
• To be eligible for the reward, a reporter must meet ALL of the following criteria:
  
  
  • Provide a description of the reproducible bug, including a script and/or detailed step-by-step instructions on how to expose the vulnerability to [email protected].
    
    
    • The reporter must include a high-level summary, detailed attack / failure scenario, proposed impact / likelihood.
    • If also providing a resolution, they must include an invitation to the relevant private GitHub repository and/or related documentation.
    • The reporter must also provide an address for the EWT bounty reward.
      
      
  • Be the first person to report the issue (all submissions will be anchored on the EW Chain in order to prove order of receipt). The process is:
    
    
    • an oracle hashes the message and creates the on-chain anchor
    • the message which confirms to the user that their submission has been received contains the anchored hash and the transaction hash it was anchored in
      
      
  • Not disclose any details of the bug / issue publicly.
    
    
  • Not be a paid auditor or contractor of EWF.
    
    
• To be eligible for an EWT and/or public recognition reward, the reporter must also provide their legal name, email address, and Energy Web Chain address.

Please contact [email protected] any further questions, and thank you for your help strengthening the Energy Web community.