+ {t("page-upgrades-bug-bounty-severity-qualifications-desc")} +
+ +
{t.rich("page-upgrades-bug-bounty-not-included-desc", {
- a: (chunks) => (
-
AE96 ED96 9E47 9B00 84F3 E17F E88D 3334 FA5F 6A0A",
- "bug-bounty-faq-q8-PGP-key": "PGP Key"
+ "bug-bounty-faq-q8-PGP-key": "PGP Key",
+ "page-upgrades-bug-bounty-severity-qualifications-title": "Vulnerability severity qualifications",
+ "page-upgrades-bug-bounty-severity-qualifications-desc": "Severity is assessed based on a discovered vulnerability's ability to do the following:",
+ "page-upgrades-bug-bounty-severity-low-title": "Low severity",
+ "page-upgrades-bug-bounty-severity-low-li-1": "Slash 0.01% of validators",
+ "page-upgrades-bug-bounty-severity-low-li-2": "Trivially cause network splits affecting 0.01% of the network",
+ "page-upgrades-bug-bounty-severity-low-li-3": "Be able to bring down 0.01% of the network by sending a single network packet or an onchain transaction",
+ "page-upgrades-bug-bounty-severity-medium-title": "Medium severity",
+ "page-upgrades-bug-bounty-severity-medium-li-1": "Slash 1% of validators",
+ "page-upgrades-bug-bounty-severity-medium-li-2": "Trivially cause network splits affecting 5% of the network",
+ "page-upgrades-bug-bounty-severity-medium-li-3": "Be able to bring down 5% of the network by sending a single network packet or an onchain transaction",
+ "page-upgrades-bug-bounty-severity-high-title": "High severity",
+ "page-upgrades-bug-bounty-severity-high-li-1": "Slash 33% of validators",
+ "page-upgrades-bug-bounty-severity-high-li-2": "Trivially cause network splits affecting 33% of the network",
+ "page-upgrades-bug-bounty-severity-high-li-3": "Be able to bring down 33% of the network by sending a single network packet or an onchain transaction",
+ "page-upgrades-bug-bounty-severity-critical-title": "Critical severity",
+ "page-upgrades-bug-bounty-severity-critical-li-1": "Slash 50% of validators",
+ "page-upgrades-bug-bounty-severity-critical-li-2": "Exploit an EIP/specification or client bug to easily create an infinite amount of ETH which is finalized by the network",
+ "page-upgrades-bug-bounty-severity-critical-li-3": "Steal ETH from all EOAs",
+ "page-upgrades-bug-bounty-severity-critical-li-4": "Burn ETH from all EOAs",
+ "page-upgrades-bug-bounty-severity-critical-li-5": "Take down the entire network by sending a single malicious onchain transaction that ends up crashing all clients",
+ "page-upgrades-bug-bounty-out-of-scope-footnote": "These are typically not included, however, we can help reach out to affected parties, such as authors or exchanges in such cases",
+ "page-upgrades-bug-bounty-not-included-li-1": "Infrastructure bugs—such as webpages, dns, email, etc.",
+ "page-upgrades-bug-bounty-not-included-li-2": "ERC-20 contract bugs",
+ "page-upgrades-bug-bounty-not-included-li-3": "Ethereum Naming Service (ENS) bugs (maintained by the ENS foundation)",
+ "page-upgrades-bug-bounty-not-included-li-4": "Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API",
+ "page-upgrades-bug-bounty-not-included-li-5": "Typographical errors",
+ "page-upgrades-bug-bounty-not-included-li-6": "Tests",
+ "page-upgrades-bug-bounty-not-included-li-7": "High-effort (sustained, CPU or bandwidth intensive, and/or requires more than 1 packet or onchain transaction) single-peer DoS attacks",
+ "page-upgrades-bug-bounty-not-included-li-8": "Any publicly known issues (includes forum posts, PRs, github issues, commits, blog posts, public discord messages, etc.)"
}