unvoid, cyberhacker ... I will try to address your suggestions very soon!
We all agreed a few weeks ago that we need some bug bounties to "stress test" the software in the testnet. In the end, Lannister will have to manage that, but as I do know the code best and you guys have very brilliant ideas, we could come up with a list of possible bounties to suggest.
As a first shot, I would come up with these possible bounties and these rules:
General rule:
All attacks must be submitted using a proof of concept script which is easily executable. The attack must be reproducable and not use any kind of 0day attack, or any other vulnerability in Java, the Operating System, or other external pieces of software. The attack must result from a faulty implementation of Elastic itself.
Every security hole must be only submitted once. When a bug submission is made, no other submissions are allowed until the bug has been fixed and confirmed to be fixed. All submissions that occur while another submission is not yet fixed are ignored and blacklisted from resubmission.
Invasion of the user's end system:
Here, any attack that shows that a program, which is written in ElasticPL and executed in Elastic's VM can escape the sandbox and gain access to the end user system. Here, it is required that the attacker is able to extract sensitive information from the attacked system such as content of the memory (which is not part of Elastic's VM) or the content of the hard drive.
Suggested Bounty: 10 BTC
Stealing user funds or causing loss of funds:
have to bump this.
Here, any attack that shows how other user's funds can be stolen or destroyed without access to the user's private key / passphrase. This attack has to work with arbitrary amounts, and does not include "rounding errors" where minimal amounts of XEL get lost. This also includes double spending a transaction without reorganizing the blockchain.
Suggested Bounty: 5 BTC
Hard Forks:
Here, any attack that shows how the blockchain can be forked in multiple chains that start coexisting and have no chance of being repaired are included.
Suggested Bounty: 2 BTC
DOS Attacks:
Here, any attacks that show how the Network can be DOS'ed are included. The DOS attack must have an efficiency of O(N^2) meaning that the negative impact on the network increases by the power of two compared to the resources invested.
Suggested Bounty: 0.5 BTC
Rounding Errors:
Demonstrate how XEL can be destroyed by exploiting rounding errors.
Suggested Bounty: 0.5 BTC
What do you think? We need a few more bounties, and we have to rethink the amounts maybe.