You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To stop `perf`, use **<CTRL+C>**, it will stop recording and close after few seconds.
48
51
49
52
-**-F** is the **frequency** (20000hz), which allows to get more precise result. If you are tracking functions taking more than 1ms, 1000hz is good enough, otherwise you need to increase it. However the more you increase, the more likely you are to miss data. If perf can't profile fast enough, it will drop some snapshot to avoid impacting the process itself.
50
53
Suggested, based on function duration: 200ms: 50000, 1s: 20000, 10+s: 1000
51
-
-**-p**the **\<pid\>** of the node
54
+
-**-p** the **\<pid\>** of the node
52
55
-**--call-graph** enables the call-graph (the function stack) using the frame-pointer that we enabled during compilation
53
-
(If you can't enable frame-pointer in the compilation, use `--call-graph dwarf` instead, and limit frequency to 2000 max)
56
+
(If you can't enable frame-pointer in the compilation, use `--call-graph dwarf` instead, and limit frequency to 2000 max)
54
57
55
58
# Generating script for speedscope
56
59
57
60
`perf` comes with a command `script` that allows to generate formatted data that can be used by other tools like speedscope. In order to produce a meaningful report.
58
61
59
62
If you want the whole report (with all the threads) simply run:
63
+
60
64
```
61
65
perf script --no-inline > perf.script.data
62
66
@@ -69,6 +73,7 @@ If you enabled the JitDump profiler at the node compilation, you need to associa
@@ -128,19 +134,18 @@ The block production is not manual (at least in normal condition), so it require
128
134
129
135
Either start the node with your synced chain, or launch a new one with `yarn run launch --chain local --port-prefix 12` (this will launch the node on port ws `12102`)
130
136
131
-
Open 3 terminals:
132
-
1. with the node logs (`tail -f 12102.log` if using local parachain)
133
-
2.with the command line ready to perf record (`perf record -F 9999 -p $(ps aux | grep moonbeam | grep 12102 | grep unsafe | tr -s " " | cut -d' ' -f 2) --call-graph fp`)
134
-
3. in the tools folder to generate some load
135
-
137
+
Open 3 terminals:
138
+
139
+
1.with the node logs (`tail -f 12102.log` if using local parachain)
140
+
2. with the command line ready to perf record (`perf record -F 9999 -p $(ps aux | grep moonbeam | grep 12102 | grep unsafe | tr -s " " | cut -d' ' -f 2) --call-graph fp`)
141
+
3. in the tools folder to generate some load
136
142
137
143
You can generate the load in many different way, ex: sending a bunch of request (`yarn ts-node scenarios/flood-evm-transfers.ts --url ws://localhost:12102 --eth-url http://localhost:12101 --amount 2 --count 1000`);
138
144
139
-
* Step 1: Generate the load
140
-
* Step 2: Look at the node logs until 1 block is produced
141
-
* Step 3: Start `perf record...` command very quickly after
142
-
* Step 4: Wait for the node logs to produce the next block (verify it contains the expected transactions)
143
-
* Step 5: Stop the `perf record...` command with \<Ctrl+C\>
145
+
- Step 1: Generate the load
146
+
- Step 2: Look at the node logs until 1 block is produced
147
+
- Step 3: Start `perf record...` command very quickly after
148
+
- Step 4: Wait for the node logs to produce the next block (verify it contains the expected transactions)
149
+
- Step 5: Stop the `perf record...` command with \<Ctrl+C\>
144
150
145
151
At this point you should have a `perf.data` file (and a `jit-xxxx.dump` if you used jitdump), follow the `Generating script for speedscope` part.
Copy file name to clipboardExpand all lines: bug-bounty.md
+25-23Lines changed: 25 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,44 +3,46 @@
3
3
The Moonbeam bug bounty program is focused on the Moonriver and Moonbeam Parachains (deployed to Kusama and Polkadot respectively) and dapps. It is focused on preventing:
4
4
5
5
Moonbeam/Moonriver:
6
-
* Thefts and freezing of principal of any amount
7
-
* Thefts and freezing of unclaimed yield of any amount
8
-
* Theft of governance funds
9
-
* Governance activity disruption
10
-
* Network shutdown
6
+
7
+
- Thefts and freezing of principal of any amount
8
+
- Thefts and freezing of unclaimed yield of any amount
9
+
- Theft of governance funds
10
+
- Governance activity disruption
11
+
- Network shutdown
11
12
12
13
Website and Apps:
13
-
* Website goes down
14
-
* Leak of user data
15
-
* Deletion of user data
16
-
* Access to sensitive pages without authorization
14
+
15
+
- Website goes down
16
+
- Leak of user data
17
+
- Deletion of user data
18
+
- Access to sensitive pages without authorization
17
19
18
20
https://immunefi.com/bounty/moonbeamnetwork/
19
21
20
22
**Blockchain and EVM/Precompiles**
21
23
22
-
| Level ||
23
-
| :--- | :--- |
24
-
| Critical | up to USD $1,000,000 |
25
-
| High | USD $75,000 |
26
-
| Medium | USD $20,000 |
27
-
| Low | USD $5,000 |
24
+
| Level ||
25
+
| :-------| :-------------------- |
26
+
| Critical | up to USD \$1,000,000 |
27
+
| High | USD \$75,000|
28
+
| Medium | USD \$20,000|
29
+
| Low | USD \$5,000|
28
30
29
31
**Website and Apps**\*
30
32
31
-
| Level ||
32
-
| :--- | :--- |
33
-
| Critical\*| USD $15,000 |
34
-
| High | USD $7,500 |
35
-
| Medium | USD $2,500 |
36
-
| Low | USD $1,000 |
33
+
| Level ||
34
+
| :---------| :----------- |
35
+
| Critical\*| USD \$15,000 |
36
+
| High | USD \$7,500|
37
+
| Medium | USD \$2,500|
38
+
| Low | USD \$1,000|
37
39
38
-
\* All web/app bug reports must come with a Proof of Concept (PoC) in order to be considered for a reward.
40
+
\* All web/app bug reports must come with a Proof of Concept (PoC) in order to be considered for a reward.
39
41
40
42
At the discretion of the team, a PoC may be required in order to determine if the bug exists, and if necessary, to calculate the extent of the damage the bug could have if exploited.
41
43
42
44
Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of USD 75 000 for Critical bug reports.
43
45
44
-
The Moonbeam Foundation requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an ID scan along with a selfie to verify identity.
46
+
The Moonbeam Foundation requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an ID scan along with a selfie to verify identity.
45
47
46
48
Payouts are handled by the Moonbeam Foundation team directly and are denominated in USD. However, payouts are done in USDT or USDC.
The default export `typesBundle` has **been removed** to avoid confusion.
13
+
The default export `typesBundle` has **been removed** to avoid confusion.
14
14
15
15
**2 new typesBundles** are available:
16
16
17
-
*`import { typesBundlePre900 } from "moonbeam-types-bundle"` to use the new naming convention
18
-
*`import { typesBundleDeprecated } from "moonbeam-types-bundle"` to keep using old naming convention that isn't camelCase (This will break at runtime 1000)
17
+
-`import { typesBundlePre900 } from "moonbeam-types-bundle"` to use the new naming convention
18
+
-`import { typesBundleDeprecated } from "moonbeam-types-bundle"` to keep using old naming convention that isn't camelCase (This will break at runtime 1000)
19
19
20
20
The following package versions have been tested:
21
21
@@ -30,6 +30,7 @@ Running the latest TypeScript version will not work.
30
30
### Breaking changes in typesBundlePre900
31
31
32
32
Those types are being changed:
33
+
33
34
```
34
35
AssetRegistrarMetadata: {
35
36
...
@@ -62,9 +63,9 @@ Those types are being changed:
62
63
63
64
## How to upgrade your tools/scripts using moonbeam-types-bundle
64
65
65
-
*(If your tool/script is not requesting past blocks, you can use the `typesBundleDeprecated`
66
-
for now and fully remove it once the network has been upgraded to runtime 900,
67
-
around Nov 18th 2021)*
66
+
_(If your tool/script is not requesting past blocks, you can use the `typesBundleDeprecated`
67
+
for now and fully remove it once the network has been upgraded to runtime 900,
68
+
around Nov 18th 2021)_
68
69
69
70
The following package versions have been tested:
70
71
@@ -79,12 +80,12 @@ Running the latest TypeScript version will not work.
79
80
Ultimately it is necessary to use the new type naming as the previous one won't be supported, but
80
81
you can import `typesBundleDeprecated` to buy yourself some time.
81
82
82
-
* moonbeam-types-bundle v1.x.x will break on runtime upgrade 900
83
-
(planned Thursday 18th November 2021 on Moonriver)
0 commit comments