Bug Bounties

Cardano Foundation

Powered by: 

Allows bounty splitting: 

Average time to first program response: 11

Average time to bounty awarded null: 

Average time to report resolved: 

Handle cardano-foundation

Managed program: true

Name: Cardano Foundation

Offers bounties: true

Offers swag: false

Response efficiency percentage: 63

Submission state: open

Url: https://hackerone.com/cardano-foundation

Website: http://cardanofoundation.org

In scope:

  • Asset identifier: Cardano-Node
  • Asset type: DOWNLOADABLE_EXECUTABLES
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Cardano-Node: https://github.com/input-output-hk/cardano-node The latest release of the node is the version that is in scope. There are multiple ways to get and run the Cardano Node (e.g. Pre-built binaries, build the node from source code, docker etc.). The preferred way is to either build from source or use the pre-built binaries. Build instructions can be found here: https://docs.cardano.org/getting-started/installing-the-cardano-node When you build you can also build the command line interface(CLI) and the Submit Api, both of which can be used to interface with the node. The latest pre-built binaries for Cardano Node can be found here: https://hydra.iohk.io/jobset/Cardano/cardano-node Within the build versions there will be a job called “cardano-deployment”, within that there will be a report that contains the configuration files for connecting to the network, for example https://hydra.iohk.io/build/6782523/download/1/index.html The node can be executed as follows: ./cardano-node run --topology ./configFiles/testnet-topology.json --database-path ./state-testnet --port 3001 --config ./configFiles/testnet-config.json --socket-path ./cardano-testnet.socket Please alter the paths referenced above to match your folder structure. For windows the socket path should look like this “ \\.\pipe\cardano-node”. The node can be run on Linux, Windows & MacOs. Only Linux is supported for Stake Pool activities, i.e. block production. The node will open up port 3001 and also a file socket. Communications protocols for the sockets are defined in the following document: https://hydra.iohk.io/build/4314538/download/2/network-spec.pdf Details for getting Testnet Ada (tAda) are here: https://testnets.cardano.org/en/testnets/cardano/tools/faucet/
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: Cardano-Wallet
  • Asset type: DOWNLOADABLE_EXECUTABLES
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Cardano-Wallet: https://github.com/input-output-hk/cardano-wallet Cardano-Wallet exposes a REST api that allows wallet based functions like sending a transaction, delegation to a pool, list addresses and transactions etc. The API documentation can be found here: https://input-output-hk.github.io/cardano-wallet/api/edge/ The latest release of Cardano-Wallet is the version that is in scope The node version in scope for testing wallet is the version that is included in the release assets, mentioned in the release notes. The preferred way is to either build from source or use the pre-built binaries that are included in the release. The wallet is built with the The wallet connects to the Cardano-Node via a file socket. The wallet can be executed as follows: ./cardano-wallet serve --node-socket ./cardano-testnet.socket --database ./wallet-db-testnet --listen-address 0.0.0.0 --testnet testnet/testnet-byron-genesis.json --port 8090 The wallet supports both Byron (Legacy) wallets and addresses and Shelley (HD) wallets and addresses. Details on wallet and address formats can be found here: https://input-output-hk.github.io/adrestia/docs/key-concepts/hierarchical-deterministic-wallets/ https://input-output-hk.github.io/adrestia/docs/key-concepts/addresses-byron/ Details for getting Testnet Ada (tAda) are here: https://testnets.cardano.org/en/testnets/cardano/tools/faucet/
  • Integrity requirements: 
  • Max severity: critical