• The bug MUST be reported to the target software author AND the organizer during the "eligibility period". You must provide evidence to demonstrate this to the organizer (e.g., provide the public / private bug report).

• The bug will be eligible to the reward levels based on its CVE CVSS score.

• There is no absolute definition of "well-known software" — it will be determined by the organizer — please contact us to confirm prior to submission.

• Challenge submissions ARE allowed to be also submitted to other bounty programs under the condition that those bug reports ALSO fulfill our bug report eligibility requirements listed above. If a submission is discovered to be reported to other bounty programs that for example, do not mention retrace, it will be disqualified from our challenge.

• The bug report MUST be confirmed and accepted by the software author to be eligible for this challenge.

• The bug report MUST

  • Describe how retrace is used to discover / reproduce it

  • Include a link to https://riboseinc.github.io/retrace/

  • Mention "This submission is in response to the Ribose Retrace Challenge"

• Critical: remote exploitable buffer overflows etc.

  • For example, can be discovered through Socket and File IO fuzzing (work in progress in retrace) or the stringinject utility.

• High: local exploitable buffer overflows etc.

  • For example, can be discovered through getenv fuzzing or the stringinject utility.

• Medium: severe crashes, buffer overflow etc.

  • Easy to discover using various retrace options, stringinject.

• Low: your average issues such as memory bugs.

  • Easy to discover using various retrace options, stringinject.

Challenge rewards are given according to the CVE CVSS score of the entry:

• Critical: 1 grand prize of $1,000

• High: 2 prizes of $500

• Medium: 3 prizes of $200

• Low: a public name mention, the journey is the reward!

The retrace team will decide among all submissions of the same class (e.g., Medium, High), which discovered bugs would receive what prize, according to criteria derived from the following angles:

• Impact of the target software and impact of the bug in target software. We seek bugs that are more general in impact; rarely occuring bugs in obscure software will be de-prioritized.

• Creativity of retrace usage.

Send an email to [email protected] with subject "Retrace Bug Challenge Submission" providing the following information:

1. Your particulars

   • Name (Title and Company if any)

   • Email

2. Bug details

   • Description

   • CVE score

   • CVE link and bug report link

   • Evidence of bug report acknowledged and confirmed by software author

   • Evidence of fulfillment of challenge eligibility criteria (e.g., inclusion of retrace usage) in the bug report

• The improvement MUST work on all supported platforms (unless it is a platform-specific improvement)

• The improvement MUST be accompanied with code to demonstrate "how the improvement is useful", and the results must be reproducible.

• The PR MUST NOT fail our builds on any platforms (Linux, \*BSD)

• Remember that this is an open source project. Your PR may be accepted and included in the retrace distribution.

• If the submission is interesting yet the quality of it needs improvement, the retrace team will provide feedback to you.

• Your submission MUST be able to be cleanly rebased by the close of submission period.

• Your code MUST be free to use by the retrace project, such as it does not violate any intellectual property rights (e.g., license agreements or patents) of third parties. Since retrace is released under the 2-clause BSD license, the submitted code will also be provided publicly under the 2-clause BSD license.

• Best Improvement Winner: 1 grand prize of $1,000

• Runner-Ups: 2 prizes of $500

• Commendable: 3 prizes of $50 each

• Worthy: incorporation into the retrace repo with a public name mention.

Submission is through GitHub Pull Requests to the retrace git repo.

• Your sample code MUST be in form of a PR.

• The PR title MUST start with "Retrace Improvement Challenge Submission: " with a brief description of improvement following that.

• The PR description must contain the following paragraph: +

• Submitted code MUST be immediately runnable and results reproducable for the organizer (i.e. include script to install any dependencies, how to run the code and verify usage).

• Submitted code MUST be runnable across all supported platforms (unless it is platform-specific).

• The PR must not fail our builds on any platforms (Linux, \*BSD)

• Remember that this is an open source project. Your PR may be accepted and included in the retrace distribution.

• If the submission is interesting yet the quality of it needs improvement, the retrace team will provide feedback to you.

• Your code MUST be free to use by the retrace project, such as it does not violate any intellectual property rights (e.g., license agreements or patents) of third parties. Since retrace is released under the 2-clause BSD license, the submitted code will also be provided publicly under the 2-clause BSD license.

• Best Usage Winner: 1 grand prize of $500

• Runner-Ups: 2 grand prizes of $200

• Commendable: 3 prizes of $50 each

• Worthy: incorporation into the retrace repo with a public name mention.

Your submission will be judged on how useful it is to the retrace target audience. The term "useful" is defined by its common English definition, with any decisions solely decided by the organizer.

Submission is through GitHub Pull Requests to the retrace git repo.

• Your sample code must be in form of a PR to the /examples directory, with a unique directory path in form of /examples/{your-github-handle}/{your-entry-name}.

• The PR title MUST start with "Retrace Usage Challenge Submission: " with a brief description of usage following that.

• The PR description must contain this phrase: "I confirm this submission is original work and will not infringe upon any intellectual property rights of any third party, and I have full rights to grant to the retrace project any rights and licenses."