Ethereum Foundation DevCon 6 - Security Track, 15 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Ethereum Foundation's Bug Bounty Program by Fredrik Svantes | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/ethereum-foundations-bug-bounty-program/

The Ethereum Foundation's Bug Bounty program is one of the longest running bounty programs for blockchains. This talk focus on its history, reported vulnerabilities, where it's heading and why having a bug bounty program is important.

Speaker(s): Fredrik Svantes
Track: Security
Keywords: security,bug bounty,vulnerabilities

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

We have a lot of security researchers, they spend all their time trying to break applications um and basically to figure out how the specifications of the protocol might be broken and then trying to sort that out. We also take in some external bug hunters from time to time and they kind of focus on a specific task at hand and also to augment that we use a bug Bounty program.

A

So the bug bunny program is there in order to allow for external researchers to come in, do some vulnerability, bug, hunting and then basically submit reports to the bug binding program, and this is done so that we can provide, rewards and other incentives to the bug Hunters.

A

So our scope is kind of wide. We have, you can see at least there. um Basically, all the clients we have, the deposit contract, solid, bugs and the specifications of the protocol, but something that we don't have, which is kind of unusual I guess, is that we don't have any scope for websites or for infrastructure or, if anything else, we focus solely on the protocol itself. You can use two different ways of having a bugabonnet program. You can use bug body program as a service, basically paying a service provider.

A

There are many of them they will come come in set up your back button program. They will provide a often very, very large, set of bug, Hunters that are ready to just start hammering on your application or you can do it in-house and there are some pros and cons for each, but the um the reason we went for an in-house solution is that ethereum is kind of complex. It requires a lot of expertise, a lot of digging through it compared to let's say, finding an SQL injection in a web application.

A

So we didn't feel that there was that much value. So that's why I went with our in-house solution and we also have a team that can triage any reports that we're receiving, but, depending on your situation, you might feel the need to go with a service provider. So, looking at the history, we can see that in 2015 we launched the first iteration of the bug boundary program.

A

It had a very narrow scope, um some execution layer, clients and the rewards were 5 BTC for consensus issue, which today would be quite a lot, but back in the time it was 1500 bucks. Over the course of the years this was increased um and in 2020 the consensus layer, bhagavani program was introduced.

A

At that time, the execution layer had a bug Bounty of up to 25 000 and the consensus Larry received a Max Bounty of fifty thousand dollars. We also have a specific thing where we will double the rewards during um basically just before hard Forks. So this is done so that we will get additional eyes on any updates that we're doing to make sure that there aren't any obvious issues and then in 2022 we merged those programs into a single one.

A

We also up the rewards to 250 000 as the base Max reward, and you can also get a 2X for a hard Fork, but for the merge itself we increased it Forex. So we had a 1 million Bounty out during the merge.

A

This is what it looked like um back in the days with the execution layer bug Bonnet program. You can see the leaderboard there and basically you submitted reports via email. You could use encryption if you wanted to, but the majority didn't do that.

A

Currently we have two ways: we have the email system where you can submit a report or you can also use a Google form.

A

What kind of surprised me is that the vast majority of people they want to use a form to do it. It's a bit easier to fill out because you have these kind of preset questions that you have to submit. But there are some security concerns with that we shall get into soon.

A

So, in the course of the bhagavani program, we have received about yeah, 200 plus vulnerabilities, that were actual vulnerabilities, counting the spam and non-vulnerabilities, probably 2 000 reports, but it's about 200, plus actual vulnerabilities, and you can find these vulnerabilities in a public disclosure repo that we have on GitHub. If you're interested in digging in a bit in what vulnerabilities, yeah we've seen, it's not completely updated. We update it after each hard Fork, so right now, I think the latest update is in May or something like that.

A

March maybe, but we will update it very soon again, given that the merchants now happen, so there will be additional ones to be found in this Repository, uh oh and if you're interested in some specific vulnerabilities learning more about uh like in detail, you can have a look at Mario's talk that he had I think two days ago, um so, like I, said we're using the Google form system right now, which isn't super good from a secured perspective, because the reports we receive are plain text or clear text.

A

Anyone can read them as long as they have access to the Google form system. So if a user with access were to be compromised or Google forms were to be compromised, then that would pose an issue, especially now that we're dealing with vulnerabilities that could affect a lot of funds. So we have been building a secure submission form which is based on openpgp.js, and this allows basically bug Hunters to submit vulnerabilities and before they're submitted.

A

The the data is encrypted on client side. So- and this means that even if someone gains access to an email account or something else, then they are basically, um they can't read anything unless they have the private key.

A

That one is not real yet available publicly, but we do have a smaller version available that people can download if they're interested in it, which is the secure drop.

A

Looking ahead, um we're working on building an encrypted vulnerability, lifecycle system. This will allow us to basically follow the vulnerability from start to end. We will be able to receive the runnability assign it to certain people, have comments, assign it to client teams and then close it as needed all while being encrypted and we're also looking at additional incentives for bounty hunters. One of them that we've been looking at is basically creating bug hunting nfts that will provide some value in real life. At events, Etc and remix team has been doing something similar.

A

So that's it for me. Thank you very much for presenting me. Stop.