Bug bounty programs allow developers to discover vulnerabilities in their applications by rewarding hackers that finds them. They are mostly held in the Web2 space, and, thus, rarely provide any form of payment guarantee to whitehats. As a result, developers are able to unfairly underpay whitehats, or even refuse to pay them.
To solve this issue, we have developed Bugless—a trustless bug bounty platform powered by Cartesi Rollups. Running inside a deterministic RISC-V machine that boots Linux, Bugless accepts applications written in any major programming language1. Through a friendly web interface, anyone can submit applications, and sponsor them with Ether to incentivize hackers! All major wallets are supported2. Meanwhile, hackers can test their exploits right on the browser, without even having to sign Web3 transactions! Once the hacker finds a valid exploit, they can finally send a transaction requesting the reward to be transferred to their account. If, however, no one is able to submit a valid exploit until a certain deadline, the sponsors may request a refund.
For your purposes, not all dependencies may be required. To help you figure out which dependencies you actually need, here is a table of dependencies for each part of the code base.
| Dependency | Version | Presentation | Back-end | Examples | Tests | Populate | CLI | Front-end |
|---|---|---|---|---|---|---|---|---|
docker |
26.1 | ☑️ | ☑️ | ☑️ | ☑️ | |||
go |
1.21.1 | ☑️ | ☑️ | |||||
jq |
1.6 | ☑️ | ||||||
pnpm |
8.15.6 | ☑️ | ||||||
cartesi |
0.14.0 | ☑️ | ☑️ |
For more info about the project, check out the slides. To build the slides, run the following command:
make slides
cartesi buildcartesi run
Before testing, you need to compile bounties binaries.
make bountiesThe following bounties will be compiled and can be used for testing:
./tests/bounties/busybox-bounty/busybox-1.36.1-bounty_riscv64.tar.xz
./tests/bounties/lua-bounty/lua-5.4.3-bounty_riscv64.tar.xz
./tests/bounties/lua-bounty/lua-5.4.6-bounty_riscv64.tar.xz
./tests/bounties/sqlite-bounty/sqlite-3.32.2-bounty_riscv64.tar.xz
./tests/bounties/sqlite-bounty/sqlite-3.43.2-bounty_riscv64.tar.xz
Along with following exploits:
./tests/bounties/busybox-bounty/exploit-busybox-1.36.1.sh
./tests/bounties/lua-bounty/exploit-lua-5.4.3.lua
./tests/bounties/sqlite-bounty/exploit-sqlite-3.32.2.sql
Before running tests, make sure you built the image and bounties, you can build them with make all.
make testTo interact with the contract, you may use the Bugless CLI. For all the options, run the command below.
go run ./cli helpgo run ./cli statego run ./cli send dapp-addressgo run ./cli send bounty \
-n "Lua Bounty" \
-d "Description of Lua bounty" \
-c ./tests/bounties/lua-bounty/lua-5.4.3-bounty_riscv64.tar.xzgo run ./cli send sponsor -b 0 -n "Sponsor Name" -v 0.05go run ./cli send exploit \
-b 0 \
-n "Hacker Name" \
-e ./tests/bounties/lua-bounty/exploit-lua-5.4.3.luago run ./cli send withdraw -b 0go run ./cli test \
-b 0 \
-e ./tests/bounties/lua-bounty/exploit-lua-5.4.3.luaRun the following command to fill up the DApp with test data.
make populateTo run the frontend, execute the commands below.
cd frontend
pnpm i
pnpm devOpen http://localhost:3000 in your browser.
The initial version of this project was developed in one week for the ETHOnline 2023 hackathon. During this one week, we had to design and implement a project from scratch. With this very tight schedule, some of the features were left out for later implementation. Below are some of those features.
- Support ENS
- Support other types of assets (ERC-20, ERC-721, and ERC-1155)
- Support syntax highlight on code blocks
- Add optional one-time setup phase for applications
- Add option to download bounty bundle
- Sandbox applications with Hypervisor
When running Bugless locally, you might want to perform some operations that would otherwise be impossible in a production environment. To this end, we advise you to install the Foundry toolkit.
When testing sponsor withdrawals, it's handy to be able to instantly advance time past the expiry date of some bounty. The following command advances time in 30 days, expressed in seconds.
cast rpc evm_increaseTime $((60*60*24*30))In order to publish transactions, you need some Ether.
The following command sets the balance of address 0xf39Fd...92266 to 1 Ether, expressed in Wei.
cast rpc anvil_setBalance 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 $(cast to-wei 1 ether)
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent