What is BNB's bug bounty program?

Binance's comprehensive bug bounty program incentivizes ethical hackers with up to $1,000,000 in BNB rewards for responsible disclosure of vulnerabilities in the BNB chain ecosystem.

Feb 15, 2025 at 11:06 pm

Key Points of BNB's Bug Bounty Program

• Program Objectives: Encourage responsible disclosure of security vulnerabilities on the BNB chain and ecosystem.
• Eligibility: Open to all security researchers and ethical hackers.
• Rewards: Up to $1,000,000 in BNB rewards for valid submissions.
• Vulnerability Classifications: Critical, High, Medium, and Low.
• Exclusions: Vulnerabilities in third-party software, Denial of Service (DoS) attacks, and previously reported vulnerabilities.
• Scope: Covers all aspects of the BNB chain and ecosystem, including the Binance Smart Chain (BSC), BNB Beacon Chain, and Binance apps and services.

Overview of BNB's Bug Bounty Program

Binance, the leading cryptocurrency exchange, has established a comprehensive bug bounty program to strengthen the security of its BNB chain ecosystem. This program aims to incentivize ethical hackers and security researchers to proactively report vulnerabilities and assist in improving the platform's resilience.

Eligibility and Reporting Process

The BNB bug bounty program is open to all individuals with technical expertise in blockchain security. Researchers who discover eligible vulnerabilities are encouraged to submit detailed reports via the dedicated HackerOne platform. The platform provides a secure channel for reporting, allowing researchers to remain anonymous and protect their submissions.

Bounty Rewards and Vulnerability Classifications

The bug bounty program offers substantial rewards for the responsible disclosure of security vulnerabilities based on their severity. The classification and corresponding bounty rewards are as follows:

Critical: $500,000 - $1,000,000
High: $100,000 - $500,000
Medium: $10,000 - $100,000
Low: Up to $10,000

Scope of the Program

The BNB bug bounty program covers a wide range of vulnerabilities within the BNB chain ecosystem, including but not limited to:

• Smart contract vulnerabilities on the Binance Smart Chain (BSC)
• Consensus layer issues on the BNB Beacon Chain
• Security flaws in Binance apps and services
• Infrastructure vulnerabilities impacting the BNB ecosystem

Exclusions

The program excludes vulnerabilities related to third-party software, Denial of Service (DoS) attacks, and vulnerabilities that have been previously reported or are publicly known. Additionally, vulnerabilities identified through automated scans or tools may not qualify for rewards.

Responsible Disclosure and Ethics

Participants in the BNB bug bounty program are expected to follow ethical principles and refrain from exploiting vulnerabilities for personal gain. Researchers should prioritize responsible disclosure by informing Binance directly about the vulnerabilities discovered and allowing sufficient time for remediation.

FAQs

Q: How do I participate in the BNB bug bounty program?
A: To participate, visit the HackerOne platform and create an account. Follow the instructions to submit a detailed report of any vulnerabilities you discover.

Q: What are the eligibility requirements for the program?
A: The program is open to all individuals with technical expertise in blockchain security. There are no formal requirements or certifications necessary.

Q: How are bounty rewards determined?
A: Rewards are based on the severity and impact of the vulnerability discovered, as classified by the Binance security team. The vulnerability classification matrix provides guidelines for assessing the rewards.

Q: What is the scope of the program?
A: The program covers all aspects of the BNB chain ecosystem, including the Binance Smart Chain (BSC), BNB Beacon Chain, and Binance apps and services.

Q: How can I ensure the anonymity of my submissions?
A: The HackerOne platform allows researchers to submit reports anonymously. Your identity will remain confidential throughout the reporting and remediation process.