--- title: "Bug bounty ledger: ZooBC blockchain security" description: "Every bug testers found on the ZooBC blockchain testnet, how each one was judged and what the Foundation paid for it: an open, public security record." url: https://zoobc.foundation/bounty/ language: en publisher: ZooBC Foundation retrieved: 2026-10-19 --- Bug bounty # What was found, and what it was worth The ZooBC testnet exists to be broken before MainNet does it for us. Findings are posted in the open — payloads, steps, and the argument about the fix, all in the same thread. This page is the other half: who found what, how it was judged, and what the Foundation paid. Checked against the forum **Sep 24, 2026, 12:00 AM UTC**. The forum moves daily — follow any link for the current state of that finding. ## Two awards, kept separate They are separate on purpose, and conflating them is how a bug programme dies. ### The severity award Scales with what was actually at risk, in four bands — **A critical**, **B high**, **C normal**, **D low**. Severity attaches to what is at risk, not to what the report claimed. A report is sometimes downgraded. It is also sometimes upgraded past what its author asked for, when the thing behind it turns out to be worse than they realised. ### The quality award Paid for work that makes a real finding better: a reproduction anyone can run, the line named, the impact sized honestly, a fix proposed, the sibling cases swept instead of stopping at the first one. It is what we pay when someone turns a thin report into one a developer can act on. It is not paid for effort alone. A report we cannot reproduce, or one that describes intended behaviour, earns no award however much work went into it, and is not listed here. We say so in the forum thread and explain why, so the next report can be a better one. **A careful report that supplies what a thinner one left out can be worth more than the finding it attaches to.** ## Reports and findings are not the same thing Some of these arrived as one report covering several faults, and were split on the forum into one topic per finding so each can be tracked and fixed on its own. Each finding below carries its own band; where it came from a larger report, the row says so and links to it. The report itself gets no row. Counting it as a finding would inflate the totals, and the reports have already been split. ## What reaches this page Only findings that have been reproduced and taken up, which on the forum means they have been moved into a curated category. The open intake categories are where anyone can post, and much of what is there has not been reproduced yet — those are not listed here. A finding appears when it is confirmed, and not before. ## How a status is decided By probing the live network, not by reading a commit message. A fix that is merged, or deployed, or described as done in a thread, is none of it recorded here as fixed until the finding itself has been re-tested against what is actually running. Where that check disagrees with what was claimed, the status is corrected here and on the forum thread, so the reporter sees the correction in the place they filed it. Two statuses were corrected that way on 21 September, both in the direction of admitting less progress than had been claimed. **A bounty page that only ever moves toward "fixed" is not worth reading.** ## The ledger 34 findings from 3 testers · checked 24 Sep 2026 | Reporter | Finding | Area | Band | Quality | Status | ZBC | | --- | --- | --- | --- | --- | --- | --- | | Aligot | [Storage endpoint serves raw uploaded files to anyone ↗](https://zoobc.pro/t/299) | Node | A | — | Confirmed, fix written, not deployed | — | | Aligot | [Wallet PIN brute-force protection bypass ↗](https://zoobc.pro/t/239) | Wallet | B | — | Fixed, live | — | | Aligot | [Stored XSS via token name in the wallet ↗](https://zoobc.pro/t/258) | Wallet | B | — | Fixed, live | — | | Aligot | [Escrow approve and reject broken ↗](https://zoobc.pro/t/266) | Wallet | B | — | Fixed, live | — | | Aligot | [Marketplace maker cannot cancel their own offer ↗](https://zoobc.pro/t/273) | Wallet | C | — | Confirmed, in progress | — | | Aligot | [Arcade game state causes a repeatable 500 ↗](https://zoobc.pro/t/297) | Node | C | — | Confirmed, in progress | — | | Aligot | [Explorer activity list drifts between pages ↗](https://zoobc.pro/t/257) | Explorer | D | — | Confirmed, not started | — | | Aligot | [Resubmitting a mined transaction reports it as new ↗](https://zoobc.pro/t/263) | Node | D | — | Confirmed, in progress | — | | Aligot | [Exchange accepts a sell larger than the balance ↗](https://zoobc.pro/t/264) | Wallet | D | — | Confirmed, not started | — | | Aligot | [Vesting total does not match what is locked ↗](https://zoobc.pro/t/265) | Wallet | D | — | Confirmed, not started | — | | Aligot | [Malformed JSON returns 500 and names the parser ↗](https://zoobc.pro/t/267) | Node | D | — | Confirmed, in progress | — | | Cebo | [Third-party script on the wallet origin, no script policy ↗](https://zoobc.pro/t/269) | Wallet | A | — | Confirmed, in progress | — | | Cebo | [Token transfer form not cleared, duplicate submit ↗](https://zoobc.pro/t/165) | Wallet | B | — | Fixed, live (awaiting re-test) | — | | Cebo | [CLI liquid-payment-stop truncates a transaction id ↗](https://zoobc.pro/t/188) | Tools | B | — | Fixed, live | — | | Cebo | [Escrow confirm omits terms, amount shown in atomic units ↗](https://zoobc.pro/t/164) | Wallet | C | — | Fixed, live (awaiting re-test) | — | | Cebo | [Activity list mislabels a scheduled transfer ↗](https://zoobc.pro/t/259) | Wallet | D | — | Confirmed, not started | — | | Cebo | [Fee overpay refunded on one escrow path, kept on the other ↗](https://zoobc.pro/t/270) | Node | D | — | Confirmed, in progress | — | | Teres | [Wallet stored XSS from on-chain data ↗](https://zoobc.pro/t/166) | Wallet | A | — | Fixed, live | — | | Teres | [Wallet stored XSS through a chat attachment ↗](https://zoobc.pro/t/268) | Wallet | A | — | Confirmed, in progress | — | | Teres | [Wallet account takeover from two localStorage blobs ↗](https://zoobc.pro/t/279) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Wallet | A | — | Fixed, live | — | | Teres | [Node crash: pre-auth SEGV via unbounded RLP recursion ↗](https://zoobc.pro/t/290) | Node | A | — | Fixed, live | — | | Teres | [Node crash: unvalidated ETH recovery id aborts the process ↗](https://zoobc.pro/t/291) | Node | A | — | Fixed, live | — | | Teres | [Node handshake accepts a caller-supplied address ↗](https://zoobc.pro/t/278) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | B | — | Partly fixed, open | — | | Teres | [Unauthenticated storage upload exhausts a node's disk ↗](https://zoobc.pro/t/289) part of [one multi-finding report ↗](https://zoobc.pro/t/271) | Node | B | — | Fixed, live | — | | Teres | [Node traffic is cleartext, so agreement between nodes proves nothing ↗](https://zoobc.pro/t/280) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | C | — | Accepted | — | | Teres | [Node API has no rate limiting and no auth-failure lockout ↗](https://zoobc.pro/t/281) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | C | — | Partly fixed, open | — | | Teres | [Wallet pages can be framed by any site ↗](https://zoobc.pro/t/292) part of [one multi-finding report ↗](https://zoobc.pro/t/271) | Wallet | C | — | Fixed, live | — | | Teres | [Origin IP is directly reachable and exposes the node ports ↗](https://zoobc.pro/t/293) | Node | C | — | Accepted | — | | Teres | [Calls relay on :8099 can be driven out of memory ↗](https://zoobc.pro/t/296) part of [one multi-finding report ↗](https://zoobc.pro/t/271) | Node | C | — | Fixed on devnet only | — | | Teres | [gRPC 1.51 and protobuf 3.21 on an unauthenticated port ↗](https://zoobc.pro/t/282) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | D | — | Accepted | — | | Teres | [Signed-request auth verifies against the caller's own key ↗](https://zoobc.pro/t/283) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | D | — | Accepted | — | | Teres | [Peer gossip exceeds the registry and crosses chains ↗](https://zoobc.pro/t/284) part of [one multi-finding report ↗](https://zoobc.pro/t/275) | Node | D | — | Accepted | — | | Teres | [Host metrics served with no authentication on every node ↗](https://zoobc.pro/t/294) | Node | D | — | Confirmed, in progress | — | | Teres | [Node leaks internal detail into its own errors ↗](https://zoobc.pro/t/295) | Node | D | — | Confirmed, in progress | — | ### Per tester | Reporter | Findings | Quality awards | Verification awards | Paid, ZBC | | --- | --- | --- | --- | --- | | Teres | 17 | 3 | — | — (18 not yet set) | | Aligot | 11 | 4 | — | — (12 not yet set) | | Cebo | 6 | 3 | 1 | — (7 not yet set) | A quality award attaches to a *report*, not to each finding in it — one report split into seven topics is one piece of work. Amounts appear once they are decided; a dash means not decided yet, never zero. ## The verification award There is a third thing worth paying for, and one person has earned it. On the CLI transaction-id truncation, Cebo found one instance — then went looking for the family, and the same bug was in three more id fields. One report, four fixes. Then, after being told the fix had shipped, they pulled the public repository, rebuilt it, and reported that the fix was not in fact there. Checking a claim like that is work, and unwelcome work at that. It is the reason this page distinguishes *fixed, live* from *merged* at all — and it is paid. ## Taking part Post in the open intake categories on [the forum](https://zoobc.pro) — one finding per topic, because a topic with three findings in it can only be judged as one. Say what you did, what happened, and what you expected. If it is reproduced and taken up, it moves to a curated category and appears here. Nothing on this page carries a payload or a reproduction. Those live on the forum, in the open, where they can be argued with. --- Source: https://zoobc.foundation/bounty/ All pages: https://zoobc.foundation/llms.txt Full text: https://zoobc.foundation/llms-full.txt