\n<\/p>\n
Following hacking @ DEVCON1<\/a>, \u00a0Martin Swende<\/a> is Nr. 1 on the leaderboard of the Ethereum Bounty Program<\/a>. The bounty program is ongoing and the last bounty awarded<\/a> amounted to 5 BTC. The program is open to anyone. With BTC Relay<\/a> getting ready for launch on Ethereum and its importance for many DApps, we want to highlight its ongoing security audit by including it in the Ethereum Bounty Program.<\/p>\n BTC Relay is an Ethereum contract that implements Bitcoin SPV: https:\/\/en.bitcoin.it\/wiki\/Thin_Client_Security<\/a><\/p>\n The chief purpose of BTC Relay is to pass along any sufficiently confirmed Bitcoin transaction, to a specified Ethereum contract. If someone makes a Bitcoin payment, or any arbitrary transaction on the canonical Bitcoin blockchain, the relay should be able to send it to any specified Ethereum contract. More details in the spec<\/a>.<\/p>\n The goal is to identify security issues such as accepting invalid blockheaders, false proofs, or invalid Bitcoin transactions. Similarly, if there is a valid Bitcoin transaction which BTC Relay does not fully relay, that would also be eligible for bounties.<\/p>\n Please note that since BTC Relay has a separate open-source grant for bounties, major bugs will be rewarded up to 1 BTC<\/b>. \u00a0Much higher rewards are possible (up to 5 BTC<\/b>) in case of very severe vulnerabilities. Rewards are eligible for everyone except bounty program judges and developers of BTC Relay.<\/p>\n The scope is on the contract, the 5 \u201c.se\u201d files in the root directory of:<\/p>\n https:\/\/github.com\/ethereum\/btcrelay\/tree\/1466934855225b1e4a87031d299c1209ba12d503<\/a><\/p>\n (This is a commit on <\/a>https:\/\/github.com\/ethereum\/btcrelay<\/a> develop branch).<\/p>\n Not in scope is complete SPV client functionality (for example Bitcoin block timestamps are not checked to save gas costs). Better mechanisms for incentivization, gas cost and other algorithm optimization are not in scope. That said, any such feedback will still be gladly considered.<\/p>\n With BTC Relay now included in the Ethereum bounty program, most of the rules on <\/a>http:\/\/bounty.ethdev.com<\/a> apply. For examples, websites are not part of the bounty program and first come, first serve — issues that have already been submitted by another user or are already known<\/a> to the team are not eligible for bounty rewards. But, this also means that beyond monetary rewards, every bounty is also eligible for:<\/p>\n\n