Sei pays out $2M bug bounty

https://usmannkhan.com/bug%20reports/2024/06/17/sei-bug-report.html

by sygma • 2 years ago

230 114 2 years ago

dheera2• 2 years ago

Honest question: Was the $2M figure advertised in advance? Where does one go about discovering bug bounties of this size?

It seems like it might be worth the gamble of taking 3-6 months off work to discover a bug of that size.

nailer2• 2 years ago

Was the $2M figure advertised in advance?

https://blog.sei.io/bug-bounty/

Where does one go about discovering bug bounties of this size?

- SECURITY.txt for individual projects.

- https://immunefi.com for blockchain in general.

- BugCrowd and HackerOne for wider tech.

I'm an infrastructure engineer though and may not be the best person to answer.

It seems like it might be worth the gamble of taking 3-6 months off work to discover a bug of that size.

https://www.hackerone.com/ethical-hacker/meet-six-hackers-ma...

Note: I work at a foundation for another blockchain. This doesn't affect anything I wrote above, just disclosing potential CoI.

danielvf4• 2 years ago

You can see lots more here:

https://immunefi.com/bug-bounty/

consumer4513• 2 years ago

Yes, that is actually worth it. This seems comparable to what a third party might pay.

I have always wondered why the payouts are capped at the trillion dollar corps at such low figures. It appears like $75k max and MS and $100k max at Apple. Meanwhile shady 3rd party groups will pay you 10x that, won't they?

cge• 2 years ago

Cryptocurrency bug bounty programs perhaps have an advantage in that the risks of classes of bugs are often concrete, financially quantifiable, immediate, and catastrophic. A bad RCE in a mainstream OS could do untold damage to users, reputational damage to the company, and so on, but even if severe, those risks have to be estimated. But in this case, for example, it seems like the $2m bounty was for a bug that, if exploited, would have made $1b in market cap disappear. I expect it's just much simpler to convince a skeptic businessperson when the risks are so clear.

stevage• 2 years ago

I wonder if very large bounties create incentives to create bugs...

tptacek4• 2 years ago

Apple outbids bottom- and mid-tier buyers, and top-tier buyers are extremely finicky about what they're buying: exploits, not vulnerabilities, for reliable bugs, with a variety of additional constraints. Apple and Google will buy exploits top-tier IC buyers won't, with less negotiation and less risk.

The major parties to this market are aware of each other and are calibrating against each other; Apple and Google aren't blowing this off. It's complicated and counterintuitive in a bunch of ways.

usmannk11• 2 years ago

It was advertised in advance, but the real gamble is on if they'll pay. If you go to my other blogpost linked in OP, you can see a case where I was owed 500k and paid 60k.

You're right though that it's a lot of risk. It's not something that most of the leaderboard works full time on, though some of us do. The immunefi homepage has a list of all the bounties on offer.

teyc• 2 years ago

Couldn’t there be a smart contract for this? I’ve no idea how.

brcmthrowaway2• 2 years ago

I worked nearly 10 years in tech and this is all gobbledygook to me. That's scary.

jerf• 2 years ago

On the blockchain, accounts have a certain amount of currency.

You can issue a command to transfer currency from your account to somebody else's, as that is a primary use case of a cryptocurrency. There was a code path where you could send someone negative amounts of the currency and it would happily pay them a negative amount of currency and charge you a negative amount of currency, thus transferring their account balance to your against their will.

There were several transfer paths and I think not all of them were vulnerable, but only one has to be. There's a bit of indirection that made it somewhat less obvious than my description makes it sound, though it amounts to the same thing in the end.

schoen• 2 years ago

There was a code path where you could send someone negative amounts of the currency and it would happily pay them a negative amount of currency and charge you a negative amount of currency, thus transferring their account balance to your against their will.

This is a bug I remember from the Apple II game "Taipan" (in which you play an 1800s opium-and-silk trader in East Asia). You could borrow negative amounts of money from a lender who charges extremely high interest. As a result, the lender would quickly end up owing you tremendous sums, without your having to do anything else. Wikipedia mentions this:

Note: A bug in the original game allows the player to overpay the moneylender, acquiring "negative debt". This "negative debt" will accumulate interest very quickly, and will count towards the player's net worth. As the game's vocabulary of number words ends at "trillion", this can cause the game to display garbage instead of the player's correct net worth. This has been fixed in the online "for browsers" version of the game.

pennybanks2• 2 years ago

it really shouldnt be referred to as currency as a whole anymore.

well i guess anything can be a currency but its too misleading even though that was by design.

if its designed to be a stock then should be called so. poker chips? in game currency? money laundering token? reward points? purchase receipt? jpeg? just think it would help

__jonas• 2 years ago

Not scary at all! The nice thing about blockchain stuff is that you can safely ignore it and it will have absolutely zero impact on your life now or at any point in the future.

hoten• 2 years ago

Unless you're a security researcher, in which case by ignoring blockchain you may be missing out on some juicy bounties.

brcmthrowaway2• 2 years ago

Could suddenly come into the picture like LLMs

theragra3• 2 years ago

Not true. My father (71) always was the same, anti-bitcoin etc. Until he needed to pay for online TV (do nt ask, but it was impossible to pay w card)

danielvf4• 2 years ago

The bounties in crypto are so big because the math is so clear on the cost vs benefits of the bounties. Paying two million to avoid losing a billion is not a bad deal. And there just aren't enough security people yet that market forces have commoditized bounty finding.

Good companies use bounties as yet another security layer - after doing everything else, add a bug bounty!

Almost all crypto bug bounties run through Immunefi. [1] There are lots of > one million dollar bounties. You can see SEI's current bounty page here.[2] The company I work (a different company) for has a one million dollar bounty listed on immunefi.com and median response time of six hours.

[1] https://immunefi.com/bug-bounty/

[2] https://immunefi.com/bug-bounty/sei/

strictnein• 2 years ago

Everything in Crypto (for both meanings of the word) has a built in bug bounty. It's just whether or not the companies want to take part in it.

j0hnyl2• 2 years ago

You could say that about anything that is critical.

BeetleB• 2 years ago

One just happens to be more legal than the other.

latchkey4• 2 years ago

Everything in finance... banks have the same bug bounty.

yieldcrv6• 2 years ago

And there just aren't enough security people yet that market forces have commoditized bounty finding.

I have the opposite conclusion there, crypto organization sponsored bug bounties are far more accurately valued than Web 2.0’s arbitrary adversarial bug bounties, and have attracted tons of developer talent to crypto bug bounties and the crypto ecosystem as a whole

j0hnyl2• 2 years ago

Crypto bug bounties require specialized low level knowledge. Web 2 pentesting is akin to a qa checklist. Imo op is right that web2 bounties are commoditized.

bigiain• 2 years ago

and have attracted tons of developer talent to crypto

And yet: "Both issues were caught after the code had been audited, merged, and slated for release"

I wonder who did those audits?

wslh• 2 years ago

The problem is that at certain level of TVL you cannot scale your security measures [1]. So, no silver bullet to security in crypto.

[1] https://bittrap.com/resources/defis-growing-pains:-as-tvl-ra...

malux85• 2 years ago

Did they get paid 2M in USD, or did they get paid 2M in magic-bean tokens, where is so little market depth that selling 30k of it would tank the market, so they will have to bleed it out slowly and hope the price doesn't tank before they exit

danielvf4• 2 years ago

[I was wrong, see below]

usmannk11• 2 years ago

This one was actually USDC! Regulated, unmagic, dollar-backed beans.

bangaladore3• 2 years ago

Magic-bean tokens. I think most on that bug-bounty site are done like that.

bangaladore3• 2 years ago

Regarding the downvotes, the company says the below in their Immunefi page. It seems (as the OP responded) that they paid out differently in this case. I am unsure why that happened or if the page is outdated.

"Payouts are handled by the Sei Foundation team directly and are denominated in USD. However, payments are done in SEI." [1]

The other part of my comment is correct according to the various Immunefi listings. Again, I could be incorrect if they do something differently behind closed doors.

[1] https://immunefi.com/bug-bounty/sei/

ohy• 2 years ago

For whom it seems surprising, that's actually rather small, considering hacks can end up in an irreversible $100M+ transfer to the malicious party.

You can check Immunefi's Bounty-Board for reference, currently paying up to $15M per find.

Another good source is rekt.news, creating post-mortems about all the DEFI-hacks and an own leaderboard, $624M for #1.

crest• 2 years ago

Sure, but you get to enjoy your bounty payout. Having $2M legally vs. having to become a money launderer?

usmannk11• 2 years ago

Right, yeah. I estimated that a savvy attacker might have been able to get out with 50 or even 100m from this, but they would also go to jail. So...

0cf8612b2e1e2• 2 years ago

Not so sure it is that clear cut. A few infamous stories of bug bounties not getting paid for even trivial amounts

So it is $2 million x probability payment vs $100 million x probability escape without getting caught.

Even with the threat of non-payment, not sure I could ever feel at ease with a multimillion bounty hanging over my head.

_940h3• 2 years ago

Taking advantage of bad contracts can be legal depending on various nuanced circumstances. If the potential payout is lucrative, then it makes sense to consult with legal counsel first.

I am not making a judgement about this specific case.

bcherny• 2 years ago

Cool writeup! This has got to be one of the biggest security bounties ever paid out, right?

usmannk11• 2 years ago

It's up there but not singularly so. Twice there have been $10M! You can see the leaderboard where the majority of crypto bounties are represented here (https://immunefi.com/leaderboard/) but you have to search around for the actual reports.

yieldcrv6• 2 years ago

nope, not at all! the crypto sector has been the most lucrative thing you can be doing in software for a decade straight now, especially with the lowest CapEx - AI doesn't even come close when factoring that in - bug bounties have been larger and only a subset are through these bug bounty brokers.

usmannk11• 2 years ago

Hey OP here, thanks for posting. Happy to answer any questions.

teschmitt• 2 years ago

What are you doing with all that dough?

ayewo2• 2 years ago

1. For the 2nd issue you found, was the amount you redeemed after being paid really up to $2m USD?

2. From your other comments elsewhere in this thread, it sounds like you are a full-time bounty hunter, correct?

usmannk11• 2 years ago

1. Yes, they sent me 2,000,000 USDC.

2. Well, I'm currently not employed full time and I do spend a lot of time bounty hunting. But I mix it in with other things as well, like competitive security reviews on https://sherlock.xyz or https://cantina.xyz and private contracted security reviews.

kubb• 2 years ago

Congrats on your skills, enjoy not having to work on things you aren’t passionate about.

y-curious• 2 years ago

Did you have to specify that it was a critical bug or haggle with them? On the immunefi site, their max bounty is set at $1M but you clearly got 2x that.

danielvf4• 2 years ago

The project changed to a 1 million dollar bounty after usmannk's report on May 18th..

There's an unofficial project that tracks bounty programs, you can see the change here: https://github.com/infosec-us-team/Immunefi-Bug-Bounty-Progr...

dustfinger• 2 years ago

1. Roughly how many hours did you spend on the two bug reports (from recon to publication) that you have posted on your blog?

2. How extensive is your background in networking, blockchain programming and pen testing?

3. How many other bounties did you commit recon time to before the two successful disclosures?

usmannk11• 2 years ago

1. This is really hard to enumerate. I basically am always doing recon and don't do it 1 target at a time either. I'd been looking at Sei's V2 upgrade code on and off for months, and made my report when they merged the v2 branch to master (this action put the code in-scope for a bounty). I'd found a handful of other critical bugs on the way but they were fixed eventually either in the course of normal development or audits. I definitely spent upwards of 40 very focused hrs in total investigating this codebase along with its dependencies Cosmos/Tendermint. Probably much more time less focused. Cosmos&TM are quite big. But those dependencies are used in many other projects too, so it can't be purely accounted towards time on Sei.

2. I am a very experienced security researcher/pentester/whatever we want to call it, specifically in the blockchain niche. I'm OK at the other stuff (reversing, cryptography, web, mobile, etc). Networking probably alright? I'm comfortable saying I have a good mind for security and a wide knowledge of the basics in many fields, then a very deep knowledge of a select few areas.

3. Idk, a lot! Upwards of 20 for sure.

rvz• 2 years ago

See. These crypto bounties pay as much or even more than big tech bug bounties.

This bounty prize is the equivalent of finding a Chrome zero day bug or an iPhone zero day RCE jailbreak. There are lots of >$1M bug bounties in crypto.

The question is, would you rather target Chrome/Safari or iPhones and find and chain-up 5 - 10 zero days for $1M+ or target crypto projects instead for $2M per project?

You're really missing out.

yao420• 2 years ago

I’m not a crypto hater (I used to work security at coinbase) but I think that while a chrome or iPhone zeroday might be worth less in bug bounty it’s worth more for a security engineers career long term.

Having the iPhone bug and the accompanying conference talk and blog post will allow you get hired by nearly any good security or tech company. No one cares about blockchain bugs except other crypto companies. When I and a bunch of other coinbase engineers were looking for jobs we were looked down at for even working in crypto. And weren’t even in the blockchain team! Just regular engineers.

I myself have dedicated a couple of months to testing gnosis and curve that each have $2 million bounties but turned up short. Last year I switched to a ML based fuzzing research and was able to speak at defcon and got crazy offers after publication.

zEddSH3• 2 years ago

Can you share more about ML based fuzzing? I do pretty basic fuzzing and that's been pretty useful at work for testing, and am keen to learn about better more modern approaches than mine!

tptacek4• 2 years ago

Serious Chrome and iPhone bug chains can be worth this much on the market, but the amount of engineering effort that goes into supporting that kind of pricing (across all the buyers, aggregated) is extreme. The subthread that unfolds from this comment is about fuzzing, but finding a vulnerability is a small part of actually selling it on the market.

Vendor bounties for these kinds of vulnerabilities are going to tend to be sharply lower than this crypto bounty, which was for a directly monetizable vulnerability. But there's a lot going into that vendor bounty price point.

4hg4ufxhy• 2 years ago

I was impressed by the fast payouts. I almost couldn't believe how easy the second one was going to be, but it turned out a bit trickier than I thought. No wonder it flew under the radar.

suzzer99• 2 years ago

Pardon my crypto ignorance, but if someone took over the entire SEI platform, wouldn't the value of SEI coin drop to zero?

ffpip3• 2 years ago

Yes, there would be no liquidity.

javier123454321• 2 years ago

Well, like Soros on the Bank of England or the attack on Terra luna, you can short SEI before the attack as well.

This is actually why "proof of stake" blockchains are fundamentally flawed. They only make sense if the value of the system is denominated in the currency of the system. It's self referential and prone to negative feedback loops. They are secure because the token is expensive, the token is expensive because it provides a secure platform. Short the token, take a loan out, compromise the security, tank the value, profit. All the mechanisms to prevent that are built into the system, like delaying the validator pool entry, but the only real backstop is a hard fork and spinning up a new copy.

latchkey4• 2 years ago

  "
  Cosmos uses go panics for error handling. Transaction runs 
  out of gas? panic. Try to spend more coins than you have? 
  panic. Invalid inputs? panic.

  ...

  For safety, later on the panic was removed entirely.
  "

Next time someone suggests using panic's as exceptions in golang... I'm going to point them at a nice $75k reason not to do that.

Sei pays out $2M bug bounty

Related Stories