2023-DoraHacks Bug Bounty
- Security / Bug Hunting
DoraHacks is a global hacker movement and the world’s most active multi-chain Web3 developer incentive platform.
The platform offers hackathons, bounty, quadratic funding, privacy voting, and other community governance/funding toolkits. In addition, over 40 major Web3 ecosystems are currently using Dora infrastructures to fund their open source communities.
More than 2000 projects from the DoraHacks community have received over $21.5 million in grants and hackathon prizes.
For more information about DoraHacks, please visit https://dorahacks.io
Reward by Threat Level
All bug reports must come with a Proof of Concept (PoC) with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.
Payouts are handled by the Dorahacks team directly and are denominated in USDC
- Goole Docs
- Critical， 300$
- High, 200$
- Medium, 100$
No Real Attack
No Real Attack to the website, or we won’t provider any bounty reward
Impacts in scope
- Direct theft of any user funds
- Permanent freezing of funds
- Break the Logic to change the user value, e.g. Vote record, Stakcing Value
Websites and Applications
- Direct theft of any user funds
- Take Over User Account
- Change Website date without admin permission
- Change User Data without login
- Website display or busniess logic error
- Theoretical vulnerabilities without any proof or demonstration
- DDos Attack
- Attacks requiring physical access to the victim device
- Reflected plain text injection eg: url parameters, path, etc.
- This does not exclude persistent plain text injection
Assets in scope
Website-Buidls, Grant, Bounty, Hackathon
Website-Stacking for voters
- DoraHacksBugBounty created the bounty on 2023/01/03 09:46:41
- priyanshuparmar submitted a solution on 2023/01/06 23:48:51WinnerLinkhttps://docs.google.com/document/d/1813mCp83g2z6Sg8AZTeRLFJfCzOk4SBTu9nlNHjWXXU/edit?usp=sharingDescriptionTitle : No rate limit on invite user in organization I have identified that when a user being invited in organization, the request has no rate limit which then can be used to loop through one request. Which can be annoying to the invited users sending the mass invitation to one email.
- Tamil-dev submitted a solution on 2023/01/08 14:46:16DescriptionHai Team, I found a vulnerability on https://dorahacks.io. Vulnerability name: IDOR
- evilboyajay submitted a solution on 2023/01/11 00:30:22WinnerLinkhttps://adjoining-direction-1d8.notion.site/Email-Disclosure-Vulnerability-on-Dorahacks-io-ccb479f99c9b4e3dbc3c58fa9ec0af09DescriptionIt has been discovered that the website dorahacks is vulnerable to email disclosure. This vulnerability allows an attacker to gain access to sensitive information, such as the email addresses of any registered users.
- evilboyajay received 100.0000 USDC reward on 2023/01/11 00:39:28
- Tamil-dev submitted a solution on 2023/01/11 15:18:47Linkhttps://docs.google.com/document/d/1KtgnM5QKlKDsJseQFj5i-EWQx9gp3CFOHhMRLoTSgWs/edit?usp=sharingDescriptionIt has been discovered that the website dorahacks is vulnerable to IDOR. This vulnerability allows an attacker to invite any members , without the permission of the organisation owner.
- priyanshuparmar received 100.0000 USDC reward on 2023/01/19 18:03:26
- priyanshuparmar submitted a solution on 2023/01/24 00:32:30Linkhttps://docs.google.com/document/d/191mCZxnFzkDIHBK0WTEHAsvAaVUKyL25dWP25yba8nA/edit?usp=sharingDescriptionEXIF metadata not stripped from uploaded profile photo and organization logo Description: In dorahacks.io you can upload a profile picture and organization logo and if you upload a JPEG with EXIF metadata on it, it isn't stripped. This can lead to disclosure of location where photo was taken or other personal information by the photo uploader if their post is public and everyone can view the post . anyone can download the logo and check the metadata. As a result, anyone can get sensitive information of users like their Geolocation, their Device information like Device Name, Version, Software & Software version used etc.