Zilliqa HackerOne

Target Policy
https://hackerone.com/zilliqa?type=team
Structured Scope
  • Asset Identifier
    Asset Type
    Max Severity
  • https://github.com/Zilliqa/ZRC/blob/master/reference/multisig_wallet.scilla

    _SMART CONTRACTS_
    **Multisig wallet contract**

    SOURCE_CODE
    critical
  • https://devex.zilliqa.com

    _DEVELOPER TOOLING_
    **Devex explorer:** Developer focused lightweight blockchain explorer

    URL
    none
  • https://docs.zilliqa.com

    This is our document repository and is currently in use. Please do not report hostile subdomain take over.

    URL
    none
  • www.zilliqa.com
    URL
    none
  • https://gov.zilliqa.com
    URL
    none
  • https://testnet-join.zilliqa.com/
    URL
    none
  • https://api.zilstream.com
    URL
    none
  • https://github.com/Zilliqa/ZRC/blob/master/reference/FungibleToken.scilla

    _SMART CONTRACTS_
    **ZRC-2 Fungible token contract**

    SOURCE_CODE
    critical
  • viewblock.com

    This is an explorer provided by our ecosystem partner and infrastructure does not belong to Zilliqa.

    URL
    none
  • https://learnscilla.com/

    **Scilla education platform**

    URL
    none
  • https://github.com/Zilliqa/gozilliqa-sdk

    _DEVELOPER TOOLING_
    **Gozilliqa SDK**

    SOURCE_CODE
    critical
  • https://testnet-stake.zilliqa.com

    _STAKING RELATED ASSETS_
    **Zillion Staking Web Portal:** Zillion is a web application that interacts with the staking smart contracts.
    * Please note that https://testnet-stake.zilliqa.com/config.js is not sensitive.

    URL
    critical
  • https://github.com/Switcheo/switcheo-tradehub-zil/blob/main/contracts/LockProxySwitcheo.scilla

    *SMART CONTRACTS*

    **ZilBridge: LockProxy contract for locking or minting of ZRC-2 assets**

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/Zilliqa-JavaScript-Library

    _DEVELOPER TOOLING_
    **Zilliqa Javascript library**

    SOURCE_CODE
    critical
  • https://zilswap.io/bridge

    *WEB BASED APPLICATION*

    **ZilBridge: Frontend (testnet) for ZilBridge beta testing**

    Security researchers are encouraged to use this frontend to interact with the bridge contracts on testnet

    Note: The web based frontend scope is limited to this specific page only.

    URL
    critical
  • https://github.com/Switcheo/switcheo-tradehub-zil/blob/main/contracts/SwitcheoTokenZRC2.scilla

    *SMART CONTRACTS*

    **ZilBridge: The bridged token (ZRC-2) token contract**

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/zilliqa-multisig-wallet

    _SMART CONTRACTS_
    **Multisig wallet Web UI:** A multisig wallet contract and frontend for the wallet

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/ZRC/blob/master/reference/nonfungible-token.scilla

    _SMART CONTRACTS_
    **ZRC-1 Non Fungible token contract**

    SOURCE_CODE
    critical
  • https://github.com/Switcheo/switcheo-tradehub-zil/blob/main/contracts/ZilCrossChainManagerProxy.scilla

    *SMART CONTRACTS*

    **ZilBridge: ZilBridge Cross chain manager proxy contract**

    Relays transaction call to Cross chain manager contract

    SOURCE_CODE
    critical
  • https://github.com/Switcheo/switcheo-tradehub-zil/blob/main/contracts/ZilCrossChainManager.scilla

    *SMART CONTRACTS*

    **ZilBridge: Cross chain manager contract**

    SOURCE_CODE
    critical
  • https://ide.zilliqa.com/

    _DEVELOPER TOOLING_
    **Neo-Savant IDE:** An IDE for writing anhttps://ide.zilliqa.com/ d deploying smart contract

    URL
    critical
  • https://dev-wallet.zilliqa.com/

    This is a testnet web used to create Zilliqa test wallets. As this has no direct impact to Zilliqa production or mainnet, we will triage valid reports but they will not be eligible for bounty.

    URL
    critical
  • https://github.com/Zilliqa/nucleus-wallet

    This is a testnet web used to create Zilliqa test wallets. As this has no direct impact to Zilliqa production or mainnet, we will triage valid reports but they will not be eligible for bounty.

    URL
    critical
  • https://github.com/Zilliqa/schnorr

    _CORE PROTOCOL AND LANGUAGE_
    **Zilliqa Schnorr library codebase:** This is the Schnorr cryptographic library for Zilliqa and the code repository is at https://github.com/Zilliqa/schnorr.

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/staking-contract/blob/main/contracts/ssnlist.scilla

    _STAKING RELATED ASSETS_
    **Seed Node Staking Contract:** Staking contract, ssnlist.scilla, is where all the staking contracts logic is implemented.

    It is the main contract that keeps track of Staked Seed Nodes aka SSNs, the delegators, the amount staked by a delegator with an SSN, and available rewards, etc.

    Deployed contract (may not be the latest version on testnet):
    https://devex.zilliqa.com/address/zil1qhpdmmpwg3y3vppkzvxtf7dcfh5l0mjm7hemjh?network=https%3A%2F%2Fdev-api.zilliqa.com

    SOURCE_CODE
    critical
  • https://dev-api.zilliqa.com/

    _CORE PROTOCOL AND LANGUAGE_
    The Zilliqa public testnet is made available for testing.

    Please do not conduct attacks that may result in a denial of service in the testnet, You may set up a local testnet by following the Readme at https://github.com/Zilliqa/Zilliqa.

    URL
    critical
  • https://github.com/Zilliqa/Zilliqa

    _CORE PROTOCOL AND LANGUAGE_
    **Zilliqa codebase:** The Zilliqa core protocol source code can be found at https://github.com/Zilliqa/Zilliqa.

    For the latest release, please the release page at https://github.com/Zilliqa/Zilliqa/releases

    We will be accepting submissions for bugs that are found in the latest release and not yet fixed in the master branch.

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/scilla

    _CORE PROTOCOL AND LANGUAGE_
    **Scilla codebase and local testnet:** The Scilla smart contract interpreter source code can be found at https://github.com/Zilliqa/scilla

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/dev-explorer

    _DEVELOPER TOOLING_
    **Devex explorer:** Developer focused lightweight blockchain explorer

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/Devex-apollo

    _DEVELOPER TOOLING_
    **GraphQL backend for Devex:** GraphQL backend for crawling blockchain data for Devex

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/ceres

    _DEVELOPER TOOLING_
    **Ceres:**
    Ceres is a graphical user interface that runs different Zilliqa development tools under Docker containers without the need of user knowing how to use docker or run it's commands. You can focus on Scilla development while Ceres manages Zilliqa Tools for you.

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/staking-contract/blob/main/contracts/proxy.scilla

    _STAKING RELATED ASSETS_
    **Seed Node Staking Proxy Contract:**
    A proxy contract that sits on top of the SSNList contract. Any call to the SSNList contract must come from SSNListProxy. This contract facilitates upgradeability of the SSNList contract in case a bug is found.

    Deployed contract (may not be the latest version on testnet):
    https://devex.zilliqa.com/address/zil1qht7zg0zqk5yhuw694s2ez3ysjqqllanrc6kvr?network=https%3A%2F%2Fdev-api.zilliqa.com

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/staking-contract/blob/main/contracts/multisig_wallet.scilla

    _STAKING RELATED ASSETS_
    **Multisig Wallet Contract:**
    This is tailored to work with the SSNListproxy contract. Certain transitions in the SSNListProxy contract can only be invoked when k-out-of-n users have agreed to do so. This logic is handled using the Wallet contract.

    Deployed contract (may not be the latest version on testnet):
    https://devex.zilliqa.com/address/zil1rddcvde5zu73fudw2vzjfplsnjqut4ae5t3fja?network=https%3A%2F%2Fdev-api.zilliqa.com

    SOURCE_CODE
    critical
  • https://github.com/Zilliqa/staking-contract/blob/main/contracts/gzil.scilla

    _STAKING RELATED ASSETS_
    **gZIL Token Contract:**
    A proxy contract that sits on top of the SSNList contract. Any call to the SSNList contract must come from SSNListProxy. This contract facilitates upgradeability of the SSNList contract in case a bug is found.

    Deployed contract (may not be the latest version on testnet):
    https://devex.zilliqa.com/address/zil1qht7zg0zqk5yhuw694s2ez3ysjqqllanrc6kvr?network=https%3A%2F%2Fdev-api.zilliqa.com

    SOURCE_CODE
    critical
Target Scope Domains
  • dev-api.zilliqa.com
  • dev-wallet.zilliqa.com
  • ide.zilliqa.com
  • testnet-stake.zilliqa.com
  • zilswap.io
Tech Stack
Last Finished Scan:
Scan Name
Fleet
Finished
State
auto-gausubs-2-kxss
allkxss
1 year, 1 month ago
Finished
auto-gausubs-2-kxss
  • Fleet: allkxss
  • Duration: 18.12 Minutes
  • Finished: 1 year, 1 month ago