Eligibility and Participation Requirements

To participate in this bug bounty you must:

• Not be employed by Colony, a family member of a person employed by Colony, or a contractor of Colony.
• Not be in violation of any national state, or local law or regulation with respect to any activities directly or indirectly related to the Bug Bounty Program

To qualify for a bounty you must:

• Be the first to report a specific vulnerability
• Report a vulnerability through the process outlined in the Rules
• Disclose the vulnerability responsibly and directly to Colony. Disclosure to other third parties before or during bug review will invalidate the submission
• Not seek or leverage the vulnerability for additional or external bounties or rewards

Good Faith Participation

All participants in the Bug Bounty Program must act in good faith when investigating vulnerabilities. "Good Faith" means:

• Play by the Rules -- Abide by the terms and conditions specified herein. If you have any questions or concerns about the terms and conditions, please reach out directly to the Colony team about it
• Don't be a jerk. You should never illegally or in bad faith leverage the existence of a vulnerability or access to sensitive or confidential information, such as making extortionate demands or ransom requests or trying to shake us down. In other words, if you find a vulnerability, report it to us with no conditions attached
• Work for Good -- You should never leave a system or users in a more vulnerable state than when you found them. This means that you should not engage in testing or related activities that degrades, damages, or destroys information within our systems, or that may impact our users, such as denial of service, social engineering, or spam

Failure to act in good faith will result in immediate disqualification from the Bug Bounty Program and ineligibility for receiving any benefit of the Bug Bounty Program

Service Level Agreement

After a vulnerability has been submitted either as an issue on GitHub or as an email to security@colony.io, the Colony team will evaluate and determine if the vulnerability is eligible for a bounty within 3 days.

Accepted bounties will be graded and assigned a severity according to the team's assesment within 7 days, or a total of 10 days from first submission.

Once the severity and bounty is decided, the Colony team will begin work on patching the bug. In this case, a PR will be opened that references the issue of original report. This PR may request more information from the submitter of the bug, and may accept input from external developers for fixing. Participation in resolving a vulnerability is welcome but not required to receive a bounty.

When the PR closing the referenced issue is merged to the /develop branch (and, in the case of a live mainnet deployment, an upgrade has been successfully deployed), the issue will be considered "resolved" and payment can take place.

Payment will be disbursed as DAI through the Gitcoin platform to the account which submitted the bounty report, unless otherwise requested by the submitter. Payment will take place as soon as possible following the report's resolution, but may take up to 30 days to process.

You must comply with all applicable laws in connection with your participation in this program. You are also responsible for any applicable taxes associated with any reward you receive.

Limitation of Liability

YOUR PARTICIPATION IN THE BUG BOUNTY PROGRAM IS AT YOUR OWN RISK. COLONY HEREBY DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE WITH RESPECT TO THE BUG BOUNTY PROGRAM. Colony SHALL NOT BE LIABLE FOR ANY DIRECT OR INDIRECT DAMAGES ARISING OUT OF OR RELATED TO YOUR PARTICIPATION OR INABILITY TO PARTICIPATE IN THE BUG BOUNTY PROGRAM. Colony assumes no responsibility for any computer, online, telephone transmission or technical malfunctions that may occur during participation in the bug bounty program, or for theft, destruction or unauthorized access to, or alteration of, your submission or any other materials submitted by you. Colony is not responsible for any incorrect or inaccurate information, whether caused by website users, other participants, or any of the equipment or programming associated with or utilized in the Competition, or for any technical or human error which may occur in the processing of submissions in the Competition. Colony assumes no responsibility for any error, interruption, defect, or delay in operation or transmission, failures or technical malfunction of the Internet, or any telephone network or lines, computer online systems, servers, computer equipment, software, email. Colony is not responsible for any injury or damage to participants or to any computer related to or resulting from participating or downloading materials in this program. Some jurisdictions may not allow certain limitations on liability and so the foregoing limitations may not apply to you.

Ineligible Persons

The Bug Bounty Program is not open to any of the following persons (“Ineligible Persons”): (1) anyone who is not at least the legal age of majority, at the time of Entry, to form valid contracts in their respective country, province or state of legal residence; or (2) in, a country, state, province or territory where the laws of the United States or local law prohibits participating or receiving a prize in the Bug Bounty program (including, but not limited to, Brazil, Quebec, and Cuba, Sudan, Iran, North Korea, Syria, Myanmar (formerly Burma) and any other country designated by the United States Treasury's Office of Foreign Assets Control) . Employees, independent contractors under a current services agreement with Colony and members of their immediate families (defined as parents, children, siblings and spouse, regardless of where they reside and/or those living in the same household of each) are not eligible to participate in the Bug Bounty Program. Colony reserves the right to verify eligibility and to adjudicate on any dispute at any time.

Additional Terms

We may modify the terms of this program or terminate this program at any time. We won’t apply any changes we make to these program terms retroactively.

All conditions specified in the general terms agreement of colony.io apply to this program.

1. Definitions

1.1 "Bounty", "Prize", "Payout", "Reward"

The monetary reward for submitting a vulnerability that is accepted, graded, and resolved by the process defined in the terms and conditions herein.

1.2 "Bug", "Vulnerability", "Exploit", "Bug Report", "Bug Report Issue"

A disclosure of any software flaw or attack vector submitted to the bug bounty program, and any related documentation thereof.

1.4 "Colony"

This program is sponsored by Collectively Intelligent Ltd (3 Butler House, 49-51 Curtain Road, London, United Kingdom EC2A 3PT ("Colony"). Colony is responsible for any website hosting, marketing, bug report assessment, prize disbursement, and any other activities not listed here related to the Bug Bounty Program.

1.7 "Submitter", or "Participant"

The individual or individuals disclosing a vulnerability in the bug bounty program. In the case of this program, this implies the owner of the Github account which creates and submits the bug report as an issue. This may also mean the holder of an Ethereum account requesting a prize for a submitted vulnerability, or the owner of the email address submitting a bounty privately to security@colony.io