Bounties

ROX Games is committed to maintaining the security and integrity of its platform and protecting its users' personal information. To that end, we have established a bug bounty program to encourage responsible disclosure of vulnerabilities that may be discovered on our platform. If you have found a vulnerability in our platform, we ask that you report it to us in accordance with the terms of this policy.

Eligibility:

To be eligible for a reward under this bug bounty program, you must:

• Report the vulnerability to us directly, either through the in-game support system or through our dedicated security email address.
• Provide a detailed report with reproducible steps. If the report is not detailed enough to reproduce the issue, it will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
• Only interact with accounts you own or with explicit permission of the account holder.

Impacts in Scope:

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered in-scope, even if they affect something in the assets listed below.

• Money on your account:
  • Changing any player's balance without a matching entry on their statement
  • Spending, withdrawing or moving another player's funds
  • Being paid a prize, bet return or refund you are not owed, or being paid twice
  • Entering a race, buying a horse or booking a cover without paying for it
• Races and results:
  • Changing a race's result, field or seed after entries close
  • Predicting a race's result before it is run
  • A settled race whose published result cannot be reproduced from its seed
• Horses and ownership:
  • Taking, transferring or listing a horse you do not own
  • Changing a horse's traits, DNA, rating or record outside the rules
• Web/App:
  • Leak, deletion or injection of user data
  • Injection of arbitrary HTML or JavaScript, including Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Forced browsing, or unauthorized access to user accounts, sensitive information or administrator functions
  • Automated account creation that gets around a limit, such as the signup bonus

ROX has not deployed its own smart contracts yet. When it does, the contracts that handle ROX user funds will be added to this list.

Out of Scope:

• Denial of service, load or traffic-flood attacks
• Physical attacks against our people, offices or infrastructure
• Social engineering of ROX staff or players (phishing, vishing, smishing)
• Spam, or anything that needs a victim's device or password
• Issues in third-party services we use, unless ROX's own integration is at fault

Do not test any of these. Doing so can void a reward.

Rewards

Valid reports may be rewarded at ROX Games' discretion, based on the severity and quality of each report. We review every submission and decide any reward case by case.

Rewards apply to genuine, severe issues that are not already known to the ROX team, above all anything that could lose player funds or change a race result. A reward is limited to one across all platforms.

Every report must include a proof of concept. Vulnerabilities must be original and previously unreported, and publicly disclosing a bug invalidates any reward.