AUTOMATED PROTOCOL ALLOCATIONS.

Introduction

The FOS Bug Bounty Program is designed to enhance security, stability, and trust across the entire FOS ecosystem. We invite security researchers, developers, and ethical hackers to responsibly report any identified vulnerabilities.

Valid reports will be eligible for rewards based on severity, impact, and report quality.

Scope

• Smart Contracts: Core FOS contracts • NFT contracts (ERC-721 standard) • Referral system contracts • Payment, withdrawal, and settlement logic • Admin and operator access controls
• On-chain & Blockchain Logic: Fund transfer flows • Lottery and winner selection logic • VRF and randomness usage • NFT minting, burning, and ownership • Reentrancy, overflow/underflow, and access control
• Backend & API: Blockchain-related APIs • Order registration and payment verification logic • Authentication and access control
• Frontend: Wallet connections and transaction signing • UI logic related to payments and ownership
• Infrastructure: Server security configurations • Deployment and CI/CD scripts (security-related only)

Out of Scope

• Previously reported or known issues
• Social engineering attacks
• Phishing or fake websites
• DoS / DDoS attacks
• Physical access requirements
• Code improvement or best-practice suggestions
• Third-party services or wallet vulnerabilities

Severity Classification

Reward Structure

Rewards may be issued as exclusive FOS NFTs and/or monetary rewards. The type and amount of rewards are determined based on vulnerability severity, impact, and report quality.

• NFT Reward Tiers: Critical → FOS Legend NFT • High → FOS Guardian NFT • Low → FOS Scout NFT
• The final decision regarding NFT issuance or any potential monetary reward rests with the FOS security team.

Duplicate Reporting Rule

• If the same vulnerability is reported by multiple parties, only the first valid report containing complete and reproducible details will be eligible for a reward.
• Duplicate reports, even if valid, are not eligible for rewards.

How to Report a Bug

All vulnerability reports must be submitted privately and responsibly.

• Title and brief summary
• Affected component (contract name, API, frontend, etc.)
• Proposed severity level with justification
• Detailed vulnerability description
• Step-by-step reproduction instructions
• Proof of Concept (code, transaction, or screenshots)
• Attack scenario and impact assessment
• Mitigation suggestion (optional)

Testing Rules (Testnet / Mainnet)

• Testing and exploitation on Testnet are allowed.
• Mainnet testing is limited to non-destructive Proof of Concept only.
• Any damage to real user or protocol assets is strictly prohibited.

Severity Determination Criteria

• Final severity is determined by the FOS security team.
• The primary factor is the real-world impact of the vulnerability.

Anonymous Reporting

• Anonymous submissions are allowed.
• Only a wallet address is required to receive rewards or NFTs.

Legal Boundaries

• Unauthorized access to user data is prohibited.
• System destruction, data deletion, or privacy violations are not allowed.

Review & Verification Process

• Initial report review
• Reproduction and validation
• Final severity determination
• Vulnerability remediation
• Reward determination
• Reward distribution

Responsible Disclosure Policy

• Do not exploit vulnerabilities beyond Proof of Concept
• Do not publicly disclose vulnerabilities before they are fixed
• Do not use real user funds
• Comply with local and international laws

Safe Harbor

If researchers act in good faith and in accordance with this policy, FOS will not pursue legal action against them.

Acknowledgment

• Optional public recognition
• Inclusion in the FOS Security Hall of Fame