IOST Security & Bug Bounty Program

This program covers the following official IOST projects and products:

The website scope includes backend APIs controlled by IOST that directly support the listed functionality.

Reports involving bridge or campaign smart contracts must identify the network, contract address, and connection to the official product. The IOST team will confirm whether the contract is in scope. If you are unsure, contact us before testing.

Third-party exchanges, wallets, ecosystem projects, and services not controlled by IOST are outside this program’s scope. A link from an official IOST website does not automatically bring a third-party system into scope.

We welcome reports demonstrating a meaningful security impact, including:

• Unauthorized asset transfers, permanent freezing of assets, or improper release of bridged assets.
• Transaction replay, signature verification flaws, authorization bypasses, and consensus vulnerabilities.
• Cross-chain message verification flaws, duplicate execution, or forged messages.
• Duplicate or unauthorized reward claims, incorrect reward calculations, or eligibility validation flaws affecting airdrops, staking, or other campaigns.
• Referral or business logic vulnerabilities that could result in reward losses.
• Account takeover, sensitive information disclosure, injection, remote code execution, and cross-site scripting with demonstrated impact.
• Security flaws that could disrupt nodes, explorers, or official services.

Please include:

1. 01Summary

   The vulnerability type, affected functionality, and potential impact.

2. 02Affected target

   The URL, API endpoint, code version, or commit. For smart contracts, include the network and contract address.

3. 03Reproduction materials

   Clear steps and a minimal proof of concept (PoC), or other sufficient evidence.

4. 04Testing environment

   Specify the local, isolated, or explicitly authorized environment used.

5. 05Supporting evidence

   Relevant logs, screenshots, or transaction records, with sensitive information removed.

6. 06Contact details

   Information allowing our team to follow up. Suggested remediation is welcome but optional.

• Source code, node, and smart contract testing should preferably take place in local or isolated environments.
• Active vulnerability testing against mainnet, public testnets, live websites, APIs, or deployed contracts requires prior written authorization from IOST and must remain within the agreed scope.
• Do not access or transfer other users’ assets, claim rewards more than once, alter other users’ data, or obtain unnecessary private information.
• Do not conduct denial-of-service attacks, stress testing, large-scale automated scanning, phishing, or social engineering.
• If you unexpectedly encounter sensitive data, gain additional privileges, or cause disruption, stop testing immediately, retain only the minimum necessary redacted evidence, and report the issue.
• Submit reports privately through the designated email address and coordinate disclosure with IOST to allow reasonable time for remediation and user protection.

Validated reports that meet this program’s requirements may receive up to 1,000 USDT per unique vulnerability under the standard reward program.

Critical vulnerabilities may receive rewards exceeding 1,000 USDT, subject to separate assessment and budget approval. Higher rewards are not guaranteed.

Rewards are assessed based on:

• Demonstrated security impact and severity.
• Exploitability, attack prerequisites, and affected scope.
• Report completeness, evidence quality, and reproducibility.
• Compliance with testing authorization and coordinated disclosure requirements.

Generally, only the first sufficiently detailed, reproducible report of a previously unknown vulnerability is eligible.

A single root cause affecting multiple pages, APIs, or products will generally be assessed as one vulnerability. Issues with independent root causes may be assessed separately.

The following are generally not eligible for rewards:

IOST will review submissions, request additional information where necessary, and coordinate validation, remediation, and disclosure with the reporter.

With the reporter’s consent, IOST may publicly acknowledge their contribution following coordinated disclosure.

This policy takes effect upon publication and does not retroactively change the terms applicable to previously submitted reports.