> For the complete documentation index, see [llms.txt](https://yubit.gitbook.io/yubit/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yubit.gitbook.io/yubit/other-help/yubit-bug-bounty-program.md).

# YUBIT Bug Bounty Program

We are excited to announce the launch of the **YUBIT Bug Bounty Program** and warmly encourage security researchers and community members to participate by reporting vulnerabilities.

📩 Please submit bug reports to: **<bd@yubit.com>**\
Our security team will review and validate submissions promptly and will contact you after confirmation.\
Your contributions to security are highly valued!

***

### 1. Web Bug Bounty

**Scope of Testing:**

* [www.yubit.com](https://www.yubit.com)

**Reward Range:**

* Low Risk: **$50 – $100**
* Medium Risk: **$100 – $500**
* High Risk: **$500 – $1,000**
* Critical: **$1,000 – $5,000**

***

### 2. Web Vulnerability Severity Definitions

#### (1) Critical Vulnerabilities

Affect core business systems (control systems, domain controllers, distribution systems, bastion hosts, etc.) and may cause severe damage.\
**Possible outcomes:**

* Unauthorized control of business systems
* Access to core system admin rights
* Full control over core infrastructure\
  **Examples:**
* Control of multiple devices in the internal network
* Access to backend super admin privileges, leading to major data leaks
* Smart contract overflow or race condition exploits

#### (2) High-Risk Vulnerabilities

* Privilege escalation (GetShell, command execution)
* SQL injection
* Authentication bypass, weak passwords, SSRF, sensitive data exposure
* Arbitrary file read / XXE
* Unauthorized transactions or payment logic bypass
* Severe logic flaws (e.g., login as any user, bulk password resets)
* Stored XSS (wide impact)
* Large-scale source code leak
* Smart contract privilege misconfigurations

#### (3) Medium-Risk Vulnerabilities

* User-interaction required issues (e.g., stored XSS, CSRF)
* Horizontal/parallel authorization bypass
* Denial of Service (DoS)
* CAPTCHA flaws leading to brute force attacks
* Local sensitive key leakage

#### (4) Low-Risk Vulnerabilities

* Local DoS (client crash)
* Minor information disclosure (path traversal, directory listing)
* Reflected/DOM XSS
* Basic CSRF
* URL redirection issues
* SMS/email spamming (limited per system)
* Other low-impact or unproven issues

***

### 3. Vulnerabilities Not Accepted

* Email spoofing
* User enumeration
* Self-XSS / HTML injection
* Missing CSP / SRI
* Non-sensitive CSRF
* Android configuration issues (e.g., `android:allowBackup="true"`)
* Performance-only issues (e.g., slow image rendering)
* Third-party component version disclosure (e.g., Nginx version)
* Non-security functional bugs
* Social engineering against YUBIT employees

***

### 4. Smart Contract Vulnerability Definitions

#### (1) Critical

* Manipulation of governance voting
* Direct theft of user funds (excluding unclaimed rewards)
* Permanent freezing of funds
* Miner Extractable Value (MEV) exploitation
* Insolvency of the protocol

#### (2) High Risk

* Theft or freezing of unclaimed rewards/royalties
* Temporary freezing of funds

#### (3) Medium Risk

* Contract halts due to token exhaustion
* Exploiting network congestion for profit
* Gas theft or forced excessive gas usage
* Disruptive, non-profitable sabotage

#### (4) Low Risk

* No direct fund loss but damages trust/commitments
* Informational risks (oracle errors, governance attacks, liquidity risks, Sybil attacks, etc.)
* Best-practice recommendations

***

### 5. Prohibited Activities

* Social engineering or phishing attacks
* Public disclosure or distribution of vulnerability details
* Destructive testing (only Proof of Concept is allowed)
* Unauthorized large-scale scanning
* Webpage modification, popup flooding, cookie theft, or intrusive payloads
* Any unreported damage during testing

⚠️ Failure to follow rules may result in **legal consequences**.

***

### 6. Closing Note

Thank you for contributing to the security of the YUBIT platform.\
Together, we can build a **safer and more transparent crypto ecosystem**.