@@ -3,23 +3,24 @@ title = "Azimuth Security Bounty Program"
33date = 2019-07-12
44author = "Anthony Arroyo"
55description = "Inviting you (and your friends) to help us make Azimuth as secure as possible."
6+aliases = ["/posts/essays/azimuth-security-bounty-program"]
67[taxonomies]
78posts = ["Updates"]
89+++
910
10−## TL;DR
11+, we’ve been running a private bounty program with HackerOne. We’re now taking the program public and inviting you (and your friends) to help us make Azimuth as secure as possible.
1314
1415## What is Azimuth again?
1516
16−Azimuth is [the Urbit public key infrastructure](https://urbit.org/posts/azimuth-is-on-chain/). It’s a set of Ethereum smart contracts that allow for cryptographic ownership and management of your Urbit identity. It also provides a governance mechanism whereby galaxy owners are able to propose and vote on improvements.
17+Azimuth is [the Urbit public key infrastructure](https://urbit.org/posts/azimuth-is-on-chain/). It’s a set of Ethereum smart contracts that allow for cryptographic ownership and management of Urbit identities. It also provides a governance mechanism whereby galaxy owners are able to propose and vote on improvements.
1718
18−People already [use Azimuth](https://github.com/urbit/bridge) to boot Arvo ships, spawn stars and planets for others and transfer points. But Azimuth is a general identity system, with great potential to be used beyond Arvo: there are primitives for supporting reputations, payments and securing communication channels.
19+People already [use Azimuth](https://github.com/urbit/bridge) to boot Arvo ships, spawn stars and planets for others and transfer points. But Azimuth is a general identity system, with great potential to be used beyond Arvo: there are primitives for reputation, payments and securing communication channels.
1920
2021## Security program details
2122
22−We had the Azimuth contracts audited by Open Zeppelin, Blockchain at Berkeley and Blocktrax, but we don’t want to take any chances. We’re hoping that the HackerOne program will help us get more eyes on the contracts, identify vulnerabilities and get out in front of any problems. You can find more information about the program at [our page](https://hackerone.com/tlon) on HackerOne.
23+We had the Azimuth contracts audited by [Open Zeppelin](https://openzeppelin.org/), [Blockchain at Berkeley](https://blockchain.berkeley.edu/) and [Bloctrax](https://www.bloctrax.com/), but we don’t want to take any chances. We’re hoping that the HackerOne program will help us get more eyes on the contracts, identify vulnerabilities and get out in front of any problems. You can find more information about the program at [our page](https://hackerone.com/tlon) on HackerOne.
2324
2425We’re interested in any vulnerability in the Azimuth contracts that would allow an attacker to either seize other user’s points, impersonate points or that would result in the platform becoming unusable.
2526
@@ -30,4 +31,3 @@ The program page has links and instructions on how to set up a development versi
3031We’re intentionally focusing our security efforts on Azimuth for now. Since Azimuth serves as our PKI layer, it’s the most crucial for the time being: it’s the source of truth for who owns what. We don’t want to have even a shred of a doubt that these cryptographic properties are secure.
3132
3233Of course, we’re working toward a future where you have a computer connected to this Azimuth point, and the computer has to be as secure as its identity. To achieve this, we have some more hard work to do on Arvo and our interpreter, Vere. When the time comes, we’ll also reach out for help testing vulnerabilities throughout the entire stack.
33−