Domain Takeover Vulnerability Payout

🐝 Community
#1

The Bug Bounty Swarm paid out 2.9 HNY ($2000 at time of payment) to a user for responsibly disclosing an issue that would allow someone to capture the subdomain uniswap.1hive.org. This issue has now been fixed with help from @lkngtn and @crisog .

Using the CVSS risk rating scale we scored the vulnerability 5.7 which amounts to a reward of up to $2000 in Honey as specified in the bug bounty specification.

It should be noted that this vulnerability has nothing to do with the smart contracts and although the bug bounty specification implies it is only for smart contracts we still considered it worth paying out a bounty for this disclosure.

For reference we were contacted directly on Discord and this is the original vulnerability report.

Thanks to the reporter for the responsible disclosure. We welcome any further sharing of vulnerabilities in accordance with the Bug Bounty Program.

10 Likes
#2

We are blessed to have such an active and alert community and rewarding people for pointing out vulnerabilities, even if they don’t fit the letter of the bounty, is an excellent use of resources.

#3

This should be reported to Vercel. It’s easy to forget to remove a cname record after moving to a different platform. Vercel should perform extra checks and contact former users if someone tries to reuse a previously used domain.