Web sites, web apps and mini apps operated by TON Society.
In Scope
| Target | Type | Severity | Reward |
|---|---|---|---|
ton.org |
Web | High | Bounty |
society.ton.org |
Web | High | Bounty |
blog.ton.org |
Web | Medium | Bounty |
ton.org/apiAPI routing and endpoints as Node.js serverless functions. Handles integration with CMS. |
API | Medium | Bounty |
society.ton.org/apiAPI routing and endpoints as Node.js serverless functions. Handles integration with CMS. |
API | Medium | Bounty |
society.ton.org/v1TON Society backend services that handle various integrations including content management, interaction with TON blockchain APIs, etc. |
API | Medium | Bounty |
blog.ton.org/apiAPI routing and endpoints as Node.js serverless functions. Handles integration with CMS and search engine. |
API | Medium | Bounty |
society.ton.org: cSBT claimingIssuing cSBTs covering APIs and UI part |
Web | Critical | Bounty |
t.me/theontonbot: events participationOnline events participation with claiming cSBTs. |
Web | High | Bounty |
t.me/theontonbot: NFT tickets sales |
Web | Critical | Bounty |
Out of scope
| Target | Type | Severity |
|---|---|---|
docs.ton.org |
Web | None |
IN-SCOPE VULNERABILITIES (WEB, MOBILE)
We are interested in the following vulnerabilities:
- Remote code execution (RCE)
- Injection vulnerabilities (SQL, XXE)
- File inclusions (Local & Remote)
- Access Control Issues (IDOR, Privilege Escalation, etc)
- Leakage of sensitive information
- Server-Side Request Forgery (SSRF)
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)
- Directory traversal
- Other vulnerability with a clear potential loss
IN-SCOPE VULNERABILITIES (Telegram BOT)
We are interested in the following vulnerabilities:
- Business logic issues
- Payments manipulation
- Remote code execution (RCE)
- Injection vulnerabilities (SQL, XXE)
- File inclusions (Local & Remote)
- Access Control Issues (IDOR, Privilege Escalation, etc)
- Leakage of sensitive information
- Server-Side Request Forgery (SSRF)
- Directory traversal
- Other vulnerability with a clear potential loss
OUT OF SCOPE
Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk (at our sole discretion). In general, the following vulnerabilities do not correspond to the severity threshold:
- Vulnerabilities in Telegram applications
- Assets that do not belong to the company
- Best practices concerns
- Recently (less than 30 days) disclosed 0day vulnerabilities
- Vulnerabilities affecting users of outdated browsers or platforms
- Social engineering, phishing, physical, or other fraud activities
- Reports that generated by scanners or any automated or active exploit tools
- Vulnerabilities involving active content such as web browser add-ons
- Most brute-forcing issues without clear impact
- Denial of service (DoS/DDoS)
- Theoretical issues
- Moderately Sensitive Information Disclosure
- Spam (sms, email, etc)
- MitM and local attacks
- Attacks requiring physical access to a user's device
- Vulnerabilities that require root/jailbreak
- Vulnerabilities requiring extensive user interaction
OUT OF SCOPE: WEB VULNERABILITIES
Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk (at our sole discretion). In general, the following vulnerabilities do not correspond to the severity threshold:
- Vulnerabilities in third-party applications
- Assets that do not belong to the company
- Best practices concerns
- Recently (less than 30 days) disclosed 0day vulnerabilities
- Vulnerabilities affecting users of outdated browsers or platforms
- Social engineering, phishing, physical, or other fraud activities
- Publicly accessible login panels without proof of exploitation
- Reports that state that software is out of date/vulnerable without a proof of concept
- Reports that generated by scanners or any automated or active exploit tools
- Vulnerabilities involving active content such as web browser add-ons
- Most brute-forcing issues without clear impact
- Denial of service (DoS/DDoS)
- Theoretical issues
- Moderately Sensitive Information Disclosure
- Spam (sms, email, etc)
- Missing HTTP security headers (even if those are specified in OWASP standards)
- Infrastructure vulnerabilities, including:
- Certificates/TLS/SSL-related issues;
- DNS issues (i.e. MX records, SPF records, DMARC records etc.);
- Server configuration issues (i.e., open ports, TLS, etc.)
- Open redirects
- Session fixation
- User account enumeration
- Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking
- Descriptive error messages (e.g. Stack Traces, application or server errors)
- Self-XSS that cannot be used to exploit other users
- Login & Logout CSRF
- Weak Captcha/Captcha Bypass
- Lack of Secure and HTTPOnly cookie flags
- Username/email enumeration via Login/Forgot Password Page error messages
- CSRF in forms that are available to anonymous users (e.g. the contact form)
- OPTIONS/TRACE HTTP method enabled
- Host header issues without proof-of-concept demonstrating the vulnerability
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Content Spoofing without embedded links/HTML
- Reflected File Download (RFD)
- Mixed HTTP Content
- HTTPS Mixed Content Scripts
- Manipulation with Password Reset Token
- MitM and local attacks
OUT OF SCOPE (Telegram BOT)
Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk (at our sole discretion). In general, the following vulnerabilities do not correspond to the severity threshold:
- Vulnerabilities in Telegram applications
- Assets that do not belong to the company
- Best practices concerns
- Recently (less than 30 days) disclosed 0day vulnerabilities
- Vulnerabilities affecting users of outdated browsers or platforms
- Social engineering, phishing, physical, or other fraud activities
- Reports that generated by scanners or any automated or active exploit tools
- Vulnerabilities involving active content such as web browser add-ons
- Most brute-forcing issues without clear impact
- Denial of service (DoS/DDoS)
- Theoretical issues
- Moderately Sensitive Information Disclosure
- Spam (sms, email, etc)
- MitM and local attacks
- Attacks requiring physical access to a user's device
- Vulnerabilities that require root/jailbreak
- Vulnerabilities requiring extensive user interaction
- Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
- Make every effort not to damage or restrict the availability of products, services, or infrastructure
- Avoid compromising any personal data, interruption, or degradation of any service
- Don’t access or modify other user data, localize all tests to your accounts
- Perform testing only within the scope
- Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
- Don’t spam forms or account creation flows using automated scanners
- In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
- Don’t break any law and stay in the defined scope
- Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
- Please note: TON Foundation company is entitled to make the payment in their native Toncoins
- Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
- No vulnerability disclosure, including partial is allowed for the moment.
- Please do NOT publish/discuss bugs
We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:
- You must be the first reporter of a vulnerability.
- The vulnerability must be a qualifying vulnerability
- Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
- You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
- You must not be a former or current employee of us or one of its contractor.
- ONLY USE YOUR HackerProof ADDRESS (in case of violation, no bounty can be awarded)
- Provide detailed but to-the point reproduction steps