The Aion Bounty Programs Terms and Conditions (“Terms“) cover your participation in the Aion Bounty Program (the “Program“). These Terms are between you and The Aion Foundation (“Aion,” “us” or “we“). By submitting any vulnerabilities to Aion or otherwise participating in the Program in any manner, you accept these Terms.
1. PROGRAM OVERVIEW
The Program enables users to submit vulnerabilities and exploitation techniques (“Vulnerabilities“) to Aion about eligible Aion products and services (“Products“) for a chance to earn rewards in an amount determined by Aion in its sole discretion (“Bounty“). The decisions made by Aion regarding Bounties are final and binding on participants. Aion may change or cancel the Program at any time, for any reason.
2. CHANGES TO THESE TERMS
We may change these Terms at any time, for any reason, at our descreation. Participating in the Program after the changes become effective means you agree to the new Terms. If you don’t agree to the new Terms, you must not participate in the Program.
If you wish to opt-out of the Program and not be considered for Bounties, contact us at [email protected] Opting out will not affect any licenses granted to Aion in any Submissions provided by you.
3. PROGRAM ELIGIBILITY
You ARE eligible to participate in the Program if you meet all of the following criteria:
- You are 14 years of age or older. If you are at least 14 years old but are considered a minor in your place of residence, you must obtain your parent’s or legal guardian’s permission prior to participating in this Program; and
- You are either an individual researcher participating in your own individual capacity, or you work for an organization that permits you to participate. You are responsible for reviewing your employer’s rules for participating in this Program.
You ARE NOT eligible to participate in the Program if you meet any of the following criteria:
- You are under the age of 14;
- Your organization does not allow you to participate in these types of programs;
- You are currently an employee of Aion or an Aion affiliate, or an immediate family (parent, sibling, spouse, or child) or household member of such an employee;
- Within the six months prior to providing us your Submission you were an employee of Aion or a Aion affiliate;
- You currently (or within six months prior providing to us your Submission) perform services for Aion or a Aion affiliate in an external staff capacity, such as agency temporary worker, vendor employee, business guest, or contractor; or
- You are or were involved in any part of the development, administration, and/or execution of this Program.
It is your responsibility to comply with any polices that your employer may have that would affect your eligibility to participate in the Program. If you are participating in violation of your employer’s policies, you may be disqualified from participating or receiving any Bounty. All payments will be made in compliance with local laws, regulations, and ethics rules. Aion disclaims any and all liability or responsibility for disputes arising between an employee and their employer related to this matter.
There may be additional restrictions on your ability to enter depending upon your local law. By agreeing to these Terms, you confirm that you are complying with these laws.
4. SUBMISSION PROCESS & COORDINATED VULNERABILITY DISCLOSURE
If you believe you have identified a Vulnerability that meets the applicable requirements set forth in the Terms, you may submit it to Aion through the following process:
Each Vulnerability submitted to Aion shall be a “Submission.” Submissions must be sent to [email protected] In the initial email, specify the Vulnerability details, and specific product version numbers you used to validate your research. Please also include as much of the following information as possible:
- Type of issue (private/public key exploits, chain splitting events, equihash related exploits etc.)
- Product and version that contains the bug
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue on a fresh install
- Proof-of-concept or exploit code
- Impact of the issue, including how an attacker could exploit the issue
You must follow Coordinated Vulnerability Disclosure (CVD) when reporting all Vulnerabilities to Aion. Submissions that do not follow CVD may not be eligible for Bounties and not following CVD could disqualify you from participating in the Program in the future.
Depending on the detail of your Submission, Aion may award a Bounty of varying scale. Well-written reports and functional exploits are more likely to result in Bounties. Those Submissions that do not meet the minimum bar described above are considered incomplete and not eligible for Bounties.
Aion is not responsible for Submissions that we do not receive for any reason. If you do not receive a confirmation email after making your Submission, notify Aion at [email protected] to ensure your Submission was received.
There are no restrictions on the number of qualified Submissions you can provide and potentially be paid a Bounty for.
If you submit a Vulnerability for a product or service that is not covered by the Program at the time you submitted it, you will not be eligible to receive Bounty payments if the product or service is later added to the Program.
5. SUBMISSION LICENSE
Aion is not claiming any ownership rights to your Submission. However, by providing any Submission to Aion, you:
- grant Aion the following non-exclusive, irrevocable, perpetual, royalty free, worldwide, sub-licensable license to the intellectual property in your Submission: (i) to use, review, assess, test, and otherwise analyze your Submission; (ii) to reproduce, modify, distribute, display and perform publicly, and commercialize and create derivative works of your Submission and all its content, in whole or in part; and (iii) to feature your Submission and all of its content in connection with the marketing, sale, or promotion of this Program or other programs (including internal and external sales meetings, conference presentations, tradeshows, and screen shots of the Submission in press releases) in all media (now known or later developed);
- agree to sign any documentation that may be required for us or our designees to confirm the rights you granted above;
- understand and acknowledge that Aion may have developed or commissioned materials similar or identical to your Submission, and you waive any claims you may have resulting from any similarities to your Submission;
- understand that you are not guaranteed any compensation or credit for use of your Submission; and
- represent and warrant that your Submission is your own work, that you haven’t used information owned by another person or entity, and that you have the legal right to provide the Submission to Aion.
6. CONFIDENTIALITY OF SUBMISSIONS/ RESTRICTIONS ON DISCLOSURE
Protecting stakeholders is Aion’s highest priority. We endeavor to address each Vulnerability report in a timely manner. We require that Bounty Submissions remain confidential and cannot be disclosed to third parties or as part of paper reviews or conference submissions until you are notified by Aion in writing that the vulnerability has been fixed. You can make available high-level descriptions of your research and non-reversible demonstrations after the Vulnerability is fixed. We require that detailed proof-of-concept exploit code and details that would make attacks easier on customers be withheld for 30 days after the Vulnerability is fixed. Aion will notify you when the Vulnerability in your Submission is fixed. You may be paid prior to the fix being released and payment should not be taken as notification of fix completion. VIOLATIONS OF THIS SECTION COULD REQUIRE YOU TO RETURN ANY BOUNTIES PAID FOR THAT VULNERABILITY AND DISQUALIFY YOU FROM PARTICIPATING IN THE PROGRAM IN THE FUTURE.
7. SUBMISSION REVIEW PROCESS
After a Submission is sent to Aion in accordance with Section 4 (above), Aion engineers will review the Submission and validate its eligibility. The review time will vary depending on the complexity and completeness of your Submission, as well as on the number of Submissions we receive.
Aion retains sole discretion in determining which Submissions are qualified. If we receive multiple bug reports for the same issue from different parties, the Bounty will be granted to the first eligible Submission. If a duplicate report provides new information that was previously unknown to Aion, we may award a differential to the person submitting the duplicate report.
If you report a Vulnerability without a functioning exploit, you may be eligible for a partial Bounty. If you submit the functioning exploit within 90 days of submitting the Vulnerability, we may, in our discretion, provide an additional Bounty payment (but are not obligated to do so).
8. BOUNTY PAYMENTS
The decisions made by Aion regarding Bounties are final and binding on participants.
If we have determined that your Submission is eligible for a Bounty, we will notify you of the Bounty amount and provide you with the necessary paperwork to process your payment. You may waive the payment if you do not wish to receive a Bounty.
If there is a dispute as to who the qualified submitter is, we will consider the eligible submitter to be the authorized account holder of the email address used to enter the Program.
Before receiving a Bounty, you are required to sign an Affidavit of Eligibility (a formal statement that verifies your personal information), a Liability/Publicity Release (which provides permission for Aion to use your name and likeness without pursuing future claims). If you want to remain anonymous to the public, we will honor your request, but we must know your legal name in order to pay you. If you do not complete the required forms as instructed or do not return the required forms within the time period listed on the notification message, we may not provide payment. We cannot process payment until we have received the fully executed required documentation.
If your Submission qualifies for a Bounty, please note:
- you may not designate someone else as the Bounty;
- if you are eligible for this Program but are at least 14 years old and considered a minor in your place of residence, we may award the Bounty to your parent/legal guardian on your behalf and require them to sign all required forms on your behalf. The Bounty will be added to the taxable income of your parent/legal guardian;
- if you are unable or unwilling to accept your Bounty, we reserve the right to rescind it; and
- if you accept a Bounty, you will be solely responsible for all applicable taxes related to accepting the payment(s).
NOTE: For public sector employees (government and education), all Bounties must be awarded directly to your public sector organization and subject to receipt of a gift letter signed by the organization’s ethics officer, attorney, or designated executive/officer responsible for the organization’s gifts/ethics policy. Aion seeks to ensure that by offering Bounties under this Program, it does not create any violation of the letter or spirit of a participant’s
applicable gifts and ethics rules.
9. PUBLIC RECOGNITION
Aion may publicly recognize individuals who have been awarded Bounties. Aion at it is discretion may recognize you on web properties or other printed materials
unless you explicitly ask us not to include your name/username.
See the Aion Privacy Statement disclosures relating to the collection and use of your information in connection with the Program.
11. CODE OF CONDUCT
By participating in the Program, you will follow these rules:
- Don’t do anything illegal.
- Don’t engage in any activity that exploits, harms, or threatens to harm children.
- Don’t send spam. Spam is unwanted or unsolicited bulk email, postings, contact requests, SMS (text messages), or instant messages.
- Don’t share inappropriate content or material (involving, for example, nudity, bestiality, pornography, graphic violence, or criminal activity).
- Don’t engage in activity that is false or misleading.
- Don’t engage in activity that is harmful to you, the Program, or others (e.g., transmitting viruses, stalking, posting terrorist content, communicating hate speech, or advocating violence against others).
- Don’t infringe upon the rights of others (e.g., unauthorized sharing of copyrighted material) or engage in activity that violates the privacy of others.
- Don’t help others break these rules.
If you violate these Terms, you may be prohibited from participating in the Program in the future and any Submissions you have provided may be deemed to be ineligible for Bounty payments.
12. NO WARRANTIES
AION MAKES NO WARRANTIES, EXPRESS OR IMPLIED, GUARANTEES OR CONDITIONS WITH RESPECT TO THE PROGRAM. YOU UNDERSTAND THAT YOUR PARTICIPATION IN THE PROGRAM IS AT YOUR OWN RISK. TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAW, WE EXCLUDE ANY IMPLIED WARRANTIES IN CONNECTION WITH THE PROGRAM. YOU MAY HAVE CERTAIN RIGHTS UNDER YOUR LOCAL LAW. NOTHING IN THESE TERMS IS INTENDED TO AFFECT THOSE RIGHTS, IF THEY ARE APPLICABLE.
13. LIMITATION OF LIABILITY & BINDING ARBITRATION
If you have any basis for recovering damages in connection with the Program (including breach of these Terms), you agree that your exclusive remedy is to recover, from Aion direct damages up to $100.00. You can’t recover any other damages or losses, including direct, consequential, lost profits, special, indirect, incidental, or punitive. These limitations and exclusions apply even if this remedy doesn’t fully compensate you for any losses or fails of its essential purpose or if we knew or should have known about the possibility of the damages. To the maximum extent permitted by law, these limitations and exclusions apply to anything or any claims related to these Terms and the Program.
These Terms, the Aion Privacy Statement, and any applicable Product Program Terms are the entire agreement between you and Aion for your Participation in the Program. It supersedes any prior agreements between you and Aion regarding your participation in the Program. All parts of these Terms apply to the maximum extent permitted by relevant law. If a court or arbitrator holds that we can’t enforce a part of these Terms as written, we may replace those terms with similar terms to the extent enforceable under the relevant law, but the rest of these Terms won’t change.
15. UNSOLICITED IDEAS
Other than your Submission, Aion does not consider or accept unsolicited proposals or ideas, including without limitation ideas for new products, technologies, promotions, product names, product feedback and product improvements (“Unsolicited Feedback“). If you send any Unsolicited Feedback to Aion through the Program or otherwise, Aion makes no assurances that your ideas will be treated as confidential or proprietary.