You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*This documents 0xcert's bug bounty process and how you can get rewarded for finding issues with the ERC-721 Token Reference Implementation.*
3
+
*Bug bounty process and how you can get rewarded for finding issues with the ERC-721 Token Reference Implementation.*
4
4
5
5
## Leaderboard
6
6
@@ -12,17 +12,17 @@ The leaderboard will list all the contributors to this bounty.
12
12
13
13
## Sponsors
14
14
15
-
**Sponsor this bug bounty if you support ERC-721**. This means you will commit to paying researchers that demonstrate a problem. Contact us at [bounty@0xcert.org](mailto:bounty@0xcert.org) if interested. Thank you.
15
+
**Sponsor this bug bounty if you support ERC-721**. This means you will commit to paying researchers that demonstrate a problem. Contact us at [bounty@nibbstack.com](mailto:bounty@nibbstack.com) if interested. Thank you.
Become a sponsor and be listed here as a contributor to the bug bounty fund: `0xa2c60e9E1f6e6B2C16a6B8ECf3BdDAEf015C572b`.
20
20
21
21
## Scope of this bounty program
22
22
23
23
This bounty is open for an unlimited time. A previous limited-time bounty program was:
24
24
25
-
*[Round 1](https://github.com/0xcert/ethereum-erc721/issues/46) — **2018-05-16 at 00:01 CET** to **2018-07-16 at 23:59 CET**
25
+
*[Round 1](https://github.com/nibbstack/erc721/issues/46) — **2018-05-16 at 00:01 CET** to **2018-07-16 at 23:59 CET**
26
26
27
27
Help us find any problems with this contract and with ERC-721 in general. This bounty program's function scope includes:
28
28
@@ -35,13 +35,13 @@ Help us find any problems with this contract and with ERC-721 in general. This b
35
35
36
36
## Rules and rewards
37
37
38
-
- Issues that have already been published here or are already disclosed to the 0xcert team are not eligible for rewards (a corollary, the 0xcert team members are ineligible for rewards).
38
+
- Issues that have already been published here or are already disclosed to the Nibbstack team are not eligible for rewards (a corollary, the Nibbstack team members are ineligible for rewards).
39
39
- Social engineering, XKCD#538 attacks, bringing down Mainnet/Infura are not in scope and will NOT be paid a reward.
40
40
- Only the end-user contracts (`src/contracts/**/*.sol`) are in scope.
41
41
- Only the latest released version of this project [](https://www.npmjs.com/package/@0xcert/ethereum-erc721) is in scope.
42
42
- Only Ethereum mainnet is in scope. We intend to add other blockchains at a future date such as Hyperledger Burrow, Ethereum Classic, and POA Network.
43
-
-[GitHub Issues](https://github.com/0xcert/ethereum-erc721/issues) is the only way to report issues and request rewards.
44
-
- The 0xcert team has complete and final judgment on the acceptability of bug reports.
43
+
-[GitHub Issues](https://github.com/nibbstack/erc721/issues) is the only way to report issues and request rewards.
44
+
- The Nibbstack team has complete and final judgment on the acceptability of bug reports.
45
45
- This program is governed under the laws of the Republic of Slovenia, if there is a party that we are unable to pay due to trade embargoes or other restrictions, then we won't pay. But we are happy to cooperate by making alternate arrangements.
46
46
47
47
Following is a [risk rating model](https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology) that judges the severity of an issue based on its likelihood and impact.
@@ -54,12 +54,12 @@ Following is a [risk rating model](https://www.owasp.org/index.php/OWASP_Risk_Ra
54
54
55
55
Rewards:
56
56
57
-
-**Highest severity** — full payout of the bug bounty (10 ETH)
58
-
-**High severity** — partial payout of the bug bounty (5 ETH)
59
-
-**Medium severity** — partial payout of the bug bounty (1 ETH)
57
+
-**Highest severity** — full payout of the bug bounty (1 ETH)
58
+
-**High severity** — partial payout of the bug bounty (0.5 ETH)
59
+
-**Medium severity** — partial payout of the bug bounty (0.1 ETH)
60
60
- All eligible reports (low severity or notable) are mentioned in [this thread in a leaderboard](#leaderboard) and are eligible to receive a special bug bounty tee shirt.
61
61
- Additional rewards are available from [sponsors](#sponsors). In general, these will follow proportionally as the rewards above.
62
-
-0xcert and sponsors reserve the right to deduct from the bounty pledge when the ongoing bug reports are rewarded.
62
+
-Nibbstack and sponsors reserve the right to deduct from the bounty pledge when the ongoing bug reports are rewarded.
63
63
64
64
Examples of impact:
65
65
@@ -92,12 +92,12 @@ Rules for bounty sponsor:
92
92
* Yes. [Well known losses](https://github.com/ethereum/EIPs/issues/223) due to problems with ERC-20 have exceeded [tens of millions USD]((https://github.com/ethereum/EIPs/issues/223)). The best defense we can offer to the community is to be transparent when issues come. The following are two references on this topic to explore further.
93
93
* Schneier, Bruce. ["Damned Good Idea"](https://www.schneier.com/essay-146.html). CSO Online. Retrieved 29 April 2013.
94
94
* Heiser, Jay (January 2001). ["Exposing Infosecurity Hype"](https://web.archive.org/web/20060328012516/http://infosecuritymag.techtarget.com/articles/january01/columns_curmudgeons_corner.shtml). *Information Security Mag*. TechTarget. Archived from [the original](http://infosecuritymag.techtarget.com/articles/january01/columns_curmudgeons_corner.shtml) on 28 March 2006. Retrieved 29 April 2013.
95
-
*[:star: Star this repo](https://github.com/0xcert/ethereum-erc721/) if you are using this code. Surely you would want to know of any bugs as soon as possible.
96
-
* If you prefer to send us a bug report privately so that a fix can be developed concurrently with the announcement you are welcome to mail us at [bounty@0xcert.org](mailto:bounty@0xcert.org). You are welcome to make a hashed bug report (set issue body to hash of your message). This will still be eligible for payment and recognition.
95
+
*[:star: Star this repo](https://github.com/nibbstack/erc721/) if you are using this code. Surely you would want to know of any bugs as soon as possible.
96
+
* If you prefer to send us a bug report privately so that a fix can be developed concurrently with the announcement you are welcome to mail us at [bounty@nibbstack.com](mailto:bounty@nibbstack.com). You are welcome to make a hashed bug report (set issue body to hash of your message). This will still be eligible for payment and recognition.
97
97
98
98
* Will things change during the bounty program?
99
99
* Yes, we are seeking sponsors and will add additional prizes here if that happens.
100
-
* Yes, we will update the code and redeploy the contract. So, click [:star: STAR and :eye: WATCH](https://github.com/0xcert/ethereum-erc721/) above on this repo for updates.
100
+
* Yes, we will update the code and redeploy the contract. So, click [:star: STAR and :eye: WATCH](https://github.com/nibbstack/erc721/) above on this repo for updates.
101
101
102
102
- Taxes?
103
103
- If you earn so much money that you will need to fill out a tax form, then we will ask you to fill out a tax form. This whole program is subject to the laws of the Republic of Slovenia.
**NOTICE: This repository has been transferred from 0xcert to Nibbstack. The documentation has not yet been fully updated but you can safely continue to use the existing packages.**
6
+
5
7
This is the complete reference implementation of the [ERC-721](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md) non-fungible token standard for the Ethereum and Wanchain blockchains. It is also compatible with other EVM compatible chains like Binance Smart Chain (BSC), Avalanche (AVAX) etc. This is an open-source project, complete with [Hardhat](https://hardhat.org/) testing.
6
8
7
9
The purpose of this implementation is to provide a good starting point for anyone who wants to use and develop non-fungible tokens on the Ethereum and Wanchain blockchains. Instead of re-implementing the ERC-721 yourself you can use this code which has gone through multiple audits and we hope it will be extensively used by the community in the future.
8
10
Note that this implementation is more restrictive then the ERC-721 standard since it does not support `payable` function calls out of the box. You are however free to add this yourself.
9
11
10
-
If you are looking for a more feature-rich and advanced ERC721 implementation, then check out the [0xcert Framework](https://github.com/0xcert/framework).
12
+
If you are looking for a more feature-rich and advanced ERC-721 implementation, then check out the [0xcert Framework](https://github.com/0xcert/framework).
11
13
12
14
## Structure
13
15
@@ -34,20 +36,20 @@ There are also test mocks that can be seen [here](src/tests/mocks). These are sp
34
36
35
37
*This is the recommended installation method if you want to use this package in your JavaScript project.*
36
38
37
-
This project is [released as an npm module](https://www.npmjs.com/package/@0xcert/ethereum-erc721). You must install it using the `npm` command:
39
+
This project is [released as an npm module](https://www.npmjs.com/package/@nibbstack/erc721). You must install it using the `npm` command:
38
40
39
41
```
40
-
$ npm install @0xcert/ethereum-erc721@2.0.0
42
+
$ npm install @nibbstack/erc721@2.0.0
41
43
```
42
44
43
45
### Source
44
46
45
-
*This is the recommended installation method if you want to improve the `0xcert/ethereum-erc721` project.*
47
+
*This is the recommended installation method if you want to improve the `nibbstack/erc721` project.*
46
48
47
49
Clone this repository and install the required `npm` dependencies:
* @dev This is an example contract implementation of NFToken with metadata extension.
@@ -157,7 +159,7 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to help out.
157
159
158
160
You are somebody that reads the documentation of smart contracts and understands how the ERC-721 Token Reference Implementation works. So you have unique skills and your time is valuable. We will pay you for your contributions to this project in the form of bug reports.
159
161
160
-
If your project depends on ERC-721 or you want to help improve the assurance of this project then you can pledge a bounty. This means you will commit to paying researchers that demonstrate a problem. Contact us at [bounty@0xcert.org](mailto:bounty@0xcert.org) if interested. Thank you.
162
+
If your project depends on ERC-721 or you want to help improve the assurance of this project then you can pledge a bounty. This means you will commit to paying researchers that demonstrate a problem. Contact us at [bounty@nibbstack.com](mailto:bounty@nibbstack.com) if interested. Thank you.
161
163
162
164
Read the full [bug bounty program](BUG_BOUNTY.md).
Copy file name to clipboardExpand all lines: SECURITY.md
+2-7Lines changed: 2 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,8 @@
2
2
3
3
## Supported Versions
4
4
5
-
Only the latest minor version of ERC-721 Token — Reference Implementation is supported with security updates. These updates are published as new patch versions. All versioning follows Semantic Versioning. You can find the latest version [released on GitHub](https://github.com/0xcert/framework/releases) and simultaneously published on NPM under individual packages.
Only the latest minor version of ERC-721 Token — Reference Implementation is supported with security updates. These updates are published as new patch versions. All versioning follows Semantic Versioning. You can find the latest version [released on GitHub](https://github.com/nibbstack/erc721/releases) and simultaneously published on NPM under individual packages.
11
6
12
7
## Reporting a Vulnerability
13
8
14
-
We really appreciate your help in finding bugs and vulnerabilities in this repository. Please report bugs and vulnerabilities using [GitHub Issues](https://github.com/0xcert/framework/issues) and we will pay you according to [our bug bounty](BUG_BOUNTY.md). If you wish to report issues privately to us then you are still eligible for our bug bounty program and can see additional details on that page.
9
+
We really appreciate your help in finding bugs and vulnerabilities in this repository. Please report bugs and vulnerabilities using [GitHub Issues](https://github.com/nibbstack/erc721/issues) and we will pay you according to [our bug bounty](BUG_BOUNTY.md). If you wish to report issues privately to us then you are still eligible for our bug bounty program and can see additional details on that page.
0 commit comments