Pectra Competition

Prize Distribution and Scoring

• Total Prize Pool: $2,000,000
• Primary Prize Pool: $1,750,000
• The prize distribution has 3 possible triggers:
  • If one or more valid medium severity findings are found, the total pot size is $500,000.
  • If one or more valid high severity findings are found, the total pot size is $1,000,000.
  • If one or more valid critical severity findings are found, the total pot size is $2,000,000.
• $250,000 of the prize pot is reserved for low severity and informational severity findings:
  • Each low severity finding is capped at $10,000.
  • Each informational severity finding capped at $2,000.
  • Any remaining funds from this reserved pool will be added back to the primary prize pool.

Scoring Mechanism

Point Calculation

• A critical severity finding is worth 30 points.
• A high severity finding is worth 10 points.
• A medium severity finding is worth 3 points.

Scoring described in the competition scoring page.

Live Fixes & Duplication

• Given the nature and importance of the Ethereum protocol, all of the fixes will be made to the respective public repositories during the competition as soon as a valid finding is reported.
• Duplicate findings will be considered as long as they are reported before the fixes/commits are made public. Any edits after the fix is made public will not be considered while judging these findings.

Severity Definitions & Judging

Please note:

• This competition has custom severity definitions as defined below.
• This competition is measuring the severity a vulnerability has on the entire Ethereum network.
• The Ethereum Foundation’s Protocol Security team will be judging the findings themselves and have the final word on all judging related decisions.
• The data sources for network impact are Sigma Prime's Blockprint and Supermajority as seen on clientdiversity.org.

Critical Severity

Vulnerabilities that allow an attacker to slash more than 50% of validators, exploit an EIP/specification or client bug to steal/create/control > 1000 ETH, or take down the entire network by sending a single malicious on-chain transaction that ends up crashing all clients.

High Severity

Vulnerabilities that allow an attacker to slash more than 33% of validators, trivially cause network splits affecting more than 33% of the network, or being able to bring down more than 33% of the network by sending a single network packet or an on-chain transaction.

Medium Severity

Vulnerabilities that allow an attacker to slash more than 5% of validators, trivially cause network splits affecting more than 5% of the network, or being able to bring down more than 5% of the network by sending a single network packet or an on-chain transaction.

Low Severity

Vulnerabilities that allow an attacker to slash more than 0.01% of validators, trivially cause network splits affecting at least 0.01% of the network, or being able to bring down more than 0.01% of the network by sending a single network packet or an on-chain transaction.

Informational Severity

Observations or recommendations regarding code quality, maintainability, or system architecture that do not present a direct security risk. These findings aim to provide insights for potential improvements rather than addressing an immediate vulnerability. Only applicable if the team decides to implement a change based on the report.

Documentation

• The Pectra Auditor Guide contains relevant resources for the competition.

Scope

Only Pectra specific code is in scope of this competition. Any vulnerabilities that are not specifically related to the Pectra upgrade are out of scope of the competition, and should instead be submitted via the Ethereum Foundation's Bug Bounty Program. Items scheduled for future upgrades, such as EOF or PeerDAS, are not in scope. In the case where there is an EIP that would mitigate an attack, the issue is a "known issue" and is not eligible.

Specifications

• Consensus Specifications
• Execution Specifications

EIPs

• EIP-2537: Precompile for BLS12-381 curve operations
• EIP-2935: Save historical block hashes in state
• EIP-6110: Supply validator deposits on chain
• EIP-7002: Execution layer triggerable withdrawals
• EIP-7251: Increase the MAX_EFFECTIVE_BALANCE
• EIP-7549: Move committee index outside Attestation
• EIP-7623: Increase calldata cost
• EIP-7685: General purpose execution layer requests
• EIP-7691: Blob throughput increase
• EIP-7702: Set EOA account code
• EIP-7840: Add blob schedule to EL config files

Clients

Execution Clients

• Go Ethereum
• Nethermind
• Besu
• Erigon
• Reth

Consensus Clients

• Prysm
• Lighthouse
• Teku
• Nimbus
• Lodestar
• Grandine

System Contracts

• sys-asm

Build Instructions and POC

• All required build instructions are documented within their respective repositories.
• Mandatory POC rule applies for this competition. All submissions must have a POC at the time of submission.

Out of scope

• Typographical errors.
• Non-Pectra specific vulnerabilities.
• High-effort (sustained, CPU or bandwidth intensive) single-peer DoS attacks.
• All TODO items referenced in any of the codebases are considered known issues.
• Any issue related to an open issue or PR in the respective repository.

Contact Us

For any issues or concerns regarding this competition, please reach out to the Cantina core team through the Cantina Discord.