CLV Documentations
CLV DOC
CLV DOC
  • Intro to CLV
    • About CLV πŸ€
    • Clover Finance Rebrands to CLV
    • What is CLV Chain?
    • What is CLV Wallet?
    • What is $CLV Token?
    • πŸ“£ CLV Official Channels
    • 🏘 CLV Community Channels
  • Use CLV Chain
    • πŸ“š Beginner’s Guide
      • Setup CLV Wallet
      • Setup Metamask Wallet
      • How to Get $CLV
      • Bridge Other Assets to CLV P-Chain (Parachain)
    • 🌐 Network Details
    • 🏦 Economics
      • Tokenomics
      • Inflation Design
    • πŸ—³οΈGovernance
    • πŸ™‹πŸ» CLV Chain FAQ
    • CLV P-Chain EVM Explorer
    • $CLV Cross-Chain Explorer
    • $CLV Cross-Chain Transfer
  • CLV Validator & Staking
    • What are Nominator & Validator?
    • Stake as a Nominator
    • Running a Validator or RPC Node
    • Staking FAQ
  • Use CLV Wallet
    • πŸ’° Download CLV Wallet
      • Browser Extension (Google Chrome & Brave)
      • Apple iOS (Mobile)
      • Android (Mobile)
      • Web Wallet (Universal)
    • πŸ“± CLV Mobile Wallet
    • πŸ–₯ CLV Extension Wallet
    • πŸ•ΈοΈ CLV Web Wallet
  • CLV Chain Developer Guide
    • Getting Started
    • Using Local Node
      • Using MetaMask
      • Using Remix
      • Using Web3.js
    • Using Testnet
      • Create an account
      • Faucet
      • Run a Testnet Node
      • Connect to Testnet
    • dApp Example
      • Setup dApp project
      • Setup truffle
      • The Counter Contract
      • Deploy Contract
      • Counter Webapp
    • Test Cases
    • Technical Documentations
      • CLV EVM
      • Developers Incentive
      • CLV Accounts Binding
      • Virtual Ethereum Address Binding
      • Query Balance
      • Transaction Finality
      • Web3 Compatibility
        • eth_protocolVersion
        • eth_syncing
        • eth_hashrate
        • eth_coinbase
        • eth_mining
        • eth_chainId
        • eth_gasPrice
        • eth_accounts
        • eth_blockNumber
        • eth_getBalance
        • eth_getStorageAt
        • eth_getBlock
        • eth_getTransactionCount
        • eth_getBlockTransactionCount
        • eth_getBlockUncleCount
        • eth_getCode
        • eth_sendTransaction
        • eth_sendSignedTransaction
        • eth_call
        • eth_estimateGas
        • eth_getTransaction
        • eth_getTransactionByBlockHashAndIndex
        • eth_getTransactionByBlockNumberAndIndex
        • eth_getTransactionReceipt
        • eth_getUncle
        • eth_getLogs
        • eth_getWork
        • eth_submitWork
        • eth_submitHashrate
        • eth_subscribe
        • eth_unsubscribe
        • net_version
        • net_peerCount
        • net_listening
        • web3_clientVersion
        • web3_sha3
      • CLV P-Chain Integration
  • CLV Wallet Developer Guide
    • EVM dApp Integration
    • Substrate dApp Integration
    • Solana dApp Integration
    • Kadena dApp Integration
    • Aptos dApp Integration
    • Web Wallet dApp Integration
    • dApp Interaction Protocol
    • Wallet Integration QA
  • CLV Ecosystem
    • 🏞️ Ecosystem Partners
      • CLV Chain
      • CLV Wallet
    • 🌱 Incentive Programs
      • CLV Ecosystem Grant
      • CLV Wallet Integration Grant
      • CLV Bug Bounty Program
    • Whitelist Assets on Clover P-Chain
    • Bridge assets into CLV P-Chain
  • Assets
    • πŸ”€ Glossary
      • Blockchain (in General)
      • Polkadot
      • Wallet
    • 🎟️ CLV - Polkadot Parachain Auction 2021
      • Parachain Auction Rule Announcement
      • Parachain Winning Reward Announcement
    • πŸ›οΈ Brand Pack
    • πŸ“„ Whitepaper
Powered by GitBook
On this page
  • Program Rules
  • Out of Scope Vulnerabilities
  • Disclosure Policy
  • Safe Harbor
  • To report a bug and be qualified for the bug bounty program, please fill out this form
  1. CLV Ecosystem
  2. 🌱 Incentive Programs

CLV Bug Bounty Program

Bug bounties support developers and security engineers who examine CLV code and products, and harden it against potential attack vectors now and in the future.

Program Rules

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.

  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Out of Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github, will be considered out of scope without proof that they are in-use in production

  • Any repository outside the clover-network Github organization

  • Issues/bugs/vulnerabilities specific to the given blockchain node client (e.g. Geth or Parity)

  • OS-related vulnerabilities

  • Clickjacking on pages with no sensitive actions.

  • Unauthenticated/logout/login CSRF.

  • Attacks requiring MITM or physical access to a user's device.

  • Previously known vulnerable libraries without a working Proof of Concept.

  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.

  • Missing best practices in SSL/TLS configuration.

  • Email or DNS configurations

  • Site or domain configuration

  • Any activity that could lead to the disruption of our service (DoS; please set up POCs on a private chain).

  • Executing brute force attempts to perform actions beyond a proof of concept

  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

Disclosure Policy

  • Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

PreviousCLV Wallet Integration GrantNextWhitelist Assets on Clover P-Chain

Last updated 3 years ago

To report a bug and be qualified for the bug bounty program, please fill out

this form