vulnerability disclosure statement update

Author: Unknown

Diff for: VULNERABILITY_RESPONSE_LOKI.md

@@ -0,0 +1,177 @@
+# Vulnerability disclosure Loki 
+
+1. This Vulnerability Response Process and subsequent bounty reward apply to the following:
+   -Code implementation as seen in the Loki repository which sits underneath the Loki-Project 
+   -Written research from the Loki Team which dictates said code implementation
+
+2. Researchers/Hackers: while you research/hack, we ask that you please refrain from committing the following:
+   -Denial of Service / Active exploiting against the Loki mainnet, Runechain or Service node networks
+   -Social Engineering of Loki staff, contractors or Foundation members
+   -Any physical or electronic attempts against Loki community property and/or data centers
+
+3. As a pro-privacy project we have volunteers running copies of the websites on hidden services on Tor and I2P, as well as on multiple public domains. **The live sites are NOT in the scope of this process; only the code is!**
+
+
+4. Bounty will be released for all projects in Loki (LOK) only. For more information on how to use Monero, visit the [Loki website](https://Loki.network)
+
+5. Bounty is not eligible to those who:
+   - do not abide by the VRP for responsible disclosure
+
+
+## 1. Points of contact for security issues
+
+```
+Kee [at] Loki.network
+PGP fingerprint = 8877 EEBB 9721 ABC5 DF64 9AE4 AC97 1489 5CE4 5D55
+
+```
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFrbANQBCAC5HMKeapz+WECQ3vY1XuSOM32yUfzp4V/rY5+YvJ/Gb7wxczF2
+NTLxfr7ueJTyICXcj/h7qnvdtpbN87ZhjWTZzG0lmrCIfZX75dOQIjch8DkGblEB
+RUG90edRx4GwYHPjfIUbIxYHcINKYMgH9jKqfHAVQD7HuvkBX1IYbNi/Kgj0wVgJ
+vVA94x8JCD5blqGbos7r02bZxQHujAHnC19/PQxRyZwJNI0v1xJgy6w/cQduFLzL
+GeEnkQfmJiSKEYzRLY3BYRSmysqD0bLGWLLSa1fcxAD+kllY1kSZXpHKH1XmErpi
+pRCLblQs0kZYqHDKG2gscfpuaaM4fSiGmY8nABEBAAG0H0tlZSBKZWZmZXJ5cyA8
+S2VlQGxva2kubmV0d29yaz6JATwEEwEKACYFAlrbANQCGwMFCQlmRIwFCwkIBwMF
+FQoJCAsEFgIBAAIeAQIXgAAKCRCslxSJXORdVa7zCACAw7eEYcXlZXxXOB43TSKq
+BTBtqISmu0+Me94PXNGo5XOp0gzVhgXPedbuz58Y1g9aCp0/wwg5cZvh6ky8zwgt
+q2BtayTb36elUkcejo9IdgN+1Ruzr8bUdWQrw7w/sZGgI3ZaoMlHvm7mus1cqKH4
+3gKaBYG/zPG25hgne13j365kxi+xgklvo0lL3atHV61UxdTlgDm2s4ZtfrMeV9fY
+DRwcIjzyYv3HWAJvD60dN1RHzTCBxiMiyl6HLawh/3dpHVDOAdrIGqHfIbzodVLW
+SA4JLw8at3JA8ColWkyFQj1srxvJJunT+haH32h2g9rNS/lf5z+Mdv+LfIPv/iZ5
+uQENBFrbANQBCAC+4N/f+RZ8jYHW6VLPGT8nspuEyEgE++zab5XOkS8qcnP0e2sR
+F0G1RLlJr6hfaowEqLOO0CTIguOBpRfeTWLHzSUK+w8pFx2GfvxXAyxViNbsA5/U
+E4gbDgOu8AkZWOQLK0nPnE0eyBhHCz22yTJY7P5AUcbo2jw9q9Ye78GbTQx8JPXl
+jia/VZprMILFOGQROGkH1amqDcaNuX6iOMKS6GtyP+eElPj+IWqwMUlr9aX+ptBQ
+zfsw+KzgYC+RBS44SM98ZgNBEibZXKfQMT2t80riKgRUPTBQcOref9T+jAtfZl1A
+OAKm0tLc3o0n0WvmjvxxOOfzdpvEDya12e4VABEBAAGJASUEGAEKAA8FAlrbANQC
+GwwFCQlmRIwACgkQrJcUiVzkXVWaNQf8C0oYU0iN3YuA+AXGxBlfMHlxz4xhbbd7
+Fn8EOIxi3scOltYeU/WvdSdXZ4IJEjydPo7TmVrQ746MUfLC+6ZfH9EDP322s+T/
+TYbt3oNA0RWl2CxakpIlRKgCIuC6EEc1U32nKsXH3Uz7UVx8u9GrDxSvGhTSVppN
+k3nhtcWeSBtANrWuhei1MC4+bRdHHExf6kHtdDMNsuwJmG3FtlKoP9l/Vpb3KscX
+9FqdEYPrJSNk3QrndS/a9QzWsm4PR0LTp2+2WC2cDgFjPUqZqZVLA5hSutUVTzGG
+fKg1gFLyG7Ed4fSa25pe5nUSJUCjFy1HprSM+I9IsSxc8sDll60a3Q==
+=iX6u
+-----END PGP PUBLIC KEY BLOCK-----
+```
+
+```
+Simon [at] Loki.network
+PGP fingerprint = 45FF F23B 7805 CEC7 7C7E 15F6 2246 DFA8 0945 A5BD
+```
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFrmnhgBCAC3LWatVxk3QWV7V42B++En8l3xDeQ3uAaXwRot98/4ybImAwmc
+ur4YCuLBXBiyZPrUQ8m6DxGG9a2RaNll+2dEkaxjDxIJsM7Op+2nUxlDBGrSS3Cf
+p40BxM4pDBDe1j9haSdoamujYpUDCpYTLA1npKiCUncITsmc+ivefkXBskgh66eI
+f69yEdeN7dvAqOWaaogBKucQfk9Si3MDXTAqm+hJbR1ByHBw/C0yXfNuq46mEVn6
+Tu25cquQPIfYebXldJ4MDD5vogzPJqjMH5Kna/24PqKiR9KpI8NYjUbiRlhuJj2q
+SjOvks9bJ4Qf+yp7o7qA41TCecsVxdciqtnJABEBAAG0IVNpbW9uIEhhcm1hbiA8
+c2ltb25AbG9raS5uZXR3b3JrPokBPAQTAQoAJgUCWuaeGAIbAwUJCWaEyAULCQgH
+AwUVCgkICwQWAgEAAh4BAheAAAoJECJG36gJRaW9G9QH+gLTCoILegkdJDqGvjsK
+r7eeD4jxuuRWcWohf+g/Xt9WUR4vOYdUY5+zXwpB7jMK0TKfNt2XMuWU6s32baXT
+M5dpQs7np5lCkFl7KFyz6AZtz5l8f1pW3PevMDILmqDiljFAXCYzG6GZ4AaB9s5c
+ikyrnRKreMdFLNR62pOCb5B8PAUBkT4BA5q2Yzfjo8oPX325zdsIlIOLvGDL8E2B
+28vzm0MCbnwiimCb8GlddjjpLWMjNe/SU4YeSOUxK0/zr902+X3ooJPmDtDnC5rs
+I5Kdfh7H9wWPbOcZhfYGL/pNZHIfIErY17qpNyv+s3YJNh/Be5dXG3QBbTcLH5xV
+sK65AQ0EWuaeGAEIAL3piiswJOJQHNtTbdwSc0xzTm/iPfpZUyobcSSZpVzOZUPQ
+D3ULlx/5RGO6cdwq+8Tz/OR+mUJHCJSxOnI+/PWMs+3ZyKPMIlhC9Khq3RiWHPQt
+aRD7USRSWXWwZH6JVCCFpMnhnnHfY+eJzlZC7G8nCJzUk15s/3425HTRlavfRaf7
+S6i28wQ98AEUBTITOx3mesnKF7oprZX89El/ToplC0QGRNJj7ZPPNw3QAC244u7B
+ExKiZKSWjDpcLANB6ORQv1eriy/VuIg/dDwwVIi9pR561tmqbVM7QeIsg52QpY63
+ctyHa2CrCyBt4ceR5mqJLuAWow7xmZWrT2+LA2cAEQEAAYkBJQQYAQoADwUCWuae
+GAIbDAUJCWaEyAAKCRAiRt+oCUWlvQL2B/9gcSBhf0FwAmVUVM/OFe1yww38i/xA
+IMUI5rPO8bKh5i3uOVZx7QucY9xPctu4YkCI8SgWLfOnQJtNbjbvduSVlWMjlmGW
+9qDOpjiFX95AFlUboZ5ii4hxAetFjCOqpMamd6DAFP7ojIbrOE3chN8axqOe4Lx0
+Ydsi20b25qT+IRAoIFWker14PHoAo8Xh+JgQ7tCijS8FzLpLZh/K99qhCz32FMIH
+5cMPQTI3EPCo+08tWpkjC/a/vtm/Q9/55+5mbdwRVpWfmQ1X0881PybvGqQbmfrT
+tnRmtnBe0ZSQ8P79bMq+OQMVdrCDTUEp3JqFgH1z2yd4BIeEKN69fy6Q
+=iGxZ
+-----END PGP PUBLIC KEY BLOCK-----
+```
+
+## 2. Incident response
+
+1. Researcher submits report via PGP encrypted Email to the relevant Disclosure manger (DA), use the appropriate public keys listed in section 1 to contact specific DA’s, the subject of the email should be “Vulnerability disclosure”
+
+2. In no more than 3 working days, the DA should respond to the researcher using  encrypted, secure channels
+
+3. DA makes inquiries to satisfy any needed information to confirm if submission is indeed a vulnerability
+    - a. If submission proves to be vulnerable with PoC code / exploit, proceed to next step
+    - b. If not vulnerable:
+     -i. DA responds with reasons why submission is not a vulnerability
+     -ii. DA moves discussion to a new or existing ticket on GitHub if necessary
+
+4. DA Establishes severity of vulnerability:
+    - a. HIGH: impacts network as a whole, has potential to break entire Loki network, or service nodes, could result in the loss of Loki.
+    - b. MEDIUM: impacts individual nodes, routers, wallets, or must be carefully exploited
+    - c. LOW: is not easily exploitable or is low impact
+    - d. If there are any disputes regarding bug severity, the Loki Foundation will ultimately define bug severity
+
+
+5. Respond according to the severity of the vulnerability:
+    - a. HIGH severities must be notified on website and reddit /r/LokiProject within 3 working days of classification
+     - i. The notification should list appropriate steps for users to take, if any
+     - ii. The notification must not include any details that could suggest an exploitation path
+     - iii. The latter takes precedence over the former
+    - b. MEDIUM and HIGH severities will require a Point Release
+    - c. LOW severities will be addressed in the next Regular Release
+
+6. DA and Loki project team will apply appropriate patch(es)
+    - a. DA designates a PRIVATE git "hotfix branch" to work in
+    - b. Patches are reviewed with the researcher
+    - c. Any messages associated with PUBLIC commits during the time of review should not make reference to the security nature of the PRIVATE branch or its commits
+    - d. Vulnerability announcement is drafted
+     - i. Include the severity of the vulnerability
+     - ii. Include all vulnerable systems/apps/code
+     - iii. Include solutions (if any) if patch cannot be applied
+    - e. Release date is discussed
+
+7. At release date, DA coordinates with developers to finalize update:
+    - a. Response Manager propagates the "hotfix branch" to trunk
+    - b. Response Manager includes vulnerability announcement draft in release notes
+    - c. Proceed with the Point or Regular Release
+
+## 3. Post-release disclosure process
+
+1. The DA has 90 days to fulfill all points within section 2
+
+2. If the Incident Response process in section 2 is successfully completed:
+    - a. Researcher decides whether or not to opt out of receiving name/handle/organization credit. By default, the researcher will receive name/handle/organization credit.
+     - i. If bounty is applicable, release bounty to the researcher as defined in section "Bounty Distribution"
+    - b. Finalize vulnerability announcement draft and include the following:
+     - i. Project name and URL
+     - ii. Versions known to be affected
+     - iii. Versions known to be not affected (for example, the vulnerable code was introduced in a recent version, and older versions are therefore unaffected)
+     - iv. Versions not checked
+     - v. Type of vulnerability and its impact
+     - vi. If already obtained or applicable, a CVE-ID
+     - vii. The planned, coordinated release date
+     - viii. Mitigating factors (for example, the vulnerability is only exposed in uncommon, non-default configurations)
+     - ix. Workarounds (configuration changes users can make to reduce their exposure to the vulnerability)
+     - x. If applicable, credits to the original reporter
+    - c. Release finalized vulnerability announcement on website and reddit 
+    - e. If applicable, developers request a CVE-ID
+     - i. The commit that applied the fix is made reference too in a future commit and includes a CVE-ID
+
+
+3. If the Incident Response process in section 2 is not successfully completed:
+    - a. DA and developers organize a meeting to discuss why/what points in section 2 were not resolved and how the team can resolve them in the future
+    - c. If disputes arise about whether or when to disclose information about a vulnerability, the DA will publicly discuss the issue via IRC and attempt to reach consensus
+    - d. If consensus on a timely disclosure is not met (no later than 90 days), the researcher (after 90 days) has every right to expose the vulnerability to the public
+
+## 4. Bounty Amount and distribution
+
+- The Total Pool of Loki bounties is 100,000 LOK this will decrease over time as bugs are claimed, rewards are given as a percentage of the reward pool size, incentivizing fast disclosure
+- Bug bounties are rewarded by the severity of the Bug 
+ 1. 10% reserved for LOW severity bugs
+ 2. 30% reserved for MEDIUM severity bugs
+ 3. 60% for HIGH severity bugs
+- Each bug will receive at most 10% of their relevant category dependent on the inter-category classification by the DA
+
+