버그 바운티 보상은 심각도 및 취약점의 영향력에 따라 그룹화됩니다. 각 심각도 수준에 해당하는 취약점 유형에 대한 예시와 설명은 아래에서 확인할 수 있습니다. 지급 금액은 웹사이트/앱과 스마트 계약에 대해 별도의 척도가 있는 4단계 구조로 되어 있습니다.

직책 입력

헤드라인

직책

{{currentSectionTitle}}에 대해 더 알아보기

이름

제목을 입력해 주세요

취약점과 영향을 받는 자산에 대한 간략한 설명을 입력하세요.

주제

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 낮은 종합 등급을 받은 국가에 위치하고 있습니다. 이러한 맥락적 데이터는 사기를 예방하고 완화하는 데 있어 어려움과 복잡성이 증가했음을 시사합니다.

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 중간 등급을 받은 국가에 위치하고 있습니다. 이러한 상황별 데이터는 중간 수준의 지리적 책임성을 시사하며, 따라서 사기 위험을 줄이고 완화할 수 있습니다.

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 가장 높은 종합 등급을 받은 국가에 위치해 있습니다. 이러한 상황별 데이터는 가장 높은 수준의 지리적 책임을 시사하며, 따라서 위험 감소 및 완화를 극대화합니다.

본 웹사이트에 제공된 정보는 투자 자문, 재정 자문, 거래 자문 또는 기타 어떠한 종류의 자문도 구성하지 않으며, 웹사이트의 콘텐츠를 그러한 목적으로 해석해서는 안 됩니다. CertiK는 어떠한 암호화폐의 매수, 매도 또는 보유도 권장하지 않습니다. 투자 결정을 내리기 전에 반드시 자체적인 실사를 수행하고 재정 고문과 상담하십시오.

취약점 제목

Upgrading a Web3 project is like trying to change the tires on a racecar while it’s driving at 200 mph. Because blockchains are meant to be "permanent," developers use clever tricks to update code, but these tricks create unique backdoors for hackers.

Attack surfaces introduced by upgrades and migrations

Read and Learn

Since you can't change code once it's on the blockchain, developers use a __Proxy__. Think of the Proxy as a "Phone Operator" and the Logic as the "Department." Users call the Operator, who forwards the call to the Department. An upgrade just tells the Operator to forward calls to a new Department.

The "Proxy" Concept

Imagine the Proxy contract has a filing cabinet. The first drawer is "Owner," the second is "Balances." If a new upgrade thinks the first drawer is "Balances," it will overwrite the "Owner" data. This is called a __Storage Collision__, and it can accidentally give a random user control over the whole project.

The "Storage" Mix-up

New logic contracts often need an `initialize` function (like a "Start" button). If developers forget to press this button themselves, a hacker can press it first, claim ownership of the contract, and potentially destroy it, leaving the project "bricked" and unusable.

Forgetting to "Lock the Door"

Sometimes, a user’s command and an admin’s command look identical to the computer (like two different keys fitting the same lock). A hacker might find a "Logic" function that accidentally triggers an "Admin" upgrade. This is why many projects use __Transparent Proxies__ to separate user and admin paths.


Function Clashing

Upgrades usually have a __Timelock__ (a 24-48 hour warning). However, during urgent migrations, developers might remove this timer. While helpful for speed, it creates a "Trust Window" where a dishonest developer (or a hacker who stole the admin key) could upgrade the contract to a "thief version" and steal all funds instantly.

The "Rug Pull" Window

When moving tokens from one blockchain to another (like Ethereum to Polygon), the tokens are "locked" in a vault. If the upgrade to that vault has a tiny math error, a hacker might trick the vault into thinking they deposited millions of tokens, allowing them to withdraw the real funds on the other side.

The Bridge Risk

After a migration, the old contract often still exists. If users don't move their money to the new version, they might be left on an "abandoned ship" that the developers are no longer monitoring or patching, making it an easy target for attackers.

Abandoned Versions

Upgrades are usually approved by a group of people (a Multi-Sig). During the stress of a migration, these people might be more likely to fall for __Phishing attacks__. If a hacker tricks enough signers into approving a "maintenance" transaction, they could actually be approving a malicious upgrade.

The "Multi-Sig" Weakness

Take the Quiz

To make transactions completely free for everyone. 

To act as a middleman that allows "unchangeable" contracts to be updated. 


To speed up the internet connection of the blockchain.

It makes the file size of the contract too large to fit on the blockchain. 

It prevents the developers from ever upgrading the contract again. 

It causes the new code to overwrite important data, like who the "Owner" is. 


It causes the user's phone to crash when using the app.


It locks their tokens forever so they can't sell them. 

It gives them a warning period to withdraw their money if they don't trust a new upgrade. 

It makes the blockchain process transactions only at night. 


It sets a password on the contract that changes every hour.

The contract works perfectly and is more secure.

A hacker could "initialize" it themselves and take control of it.

The tokens in the contract will double in value automatically.

Nothing; the blockchain will fix it automatically.