Bug Bounty
A bug bounty program for LUSD Chicken Bonds’ smart contracts is now live. We intend for hackers to look for smart contract vulnerabilities in our system that can lead to loss of funds or locked components.
The preferred way to submit a vulnerability is through Chicken Bonds’ Vault on the Hats Finance platform. If for any reason, Hats can't be used, vulnerabilities can also be sent using the method described below.
Rewards
Vulnerability reports will be scored using the CVSS v3 standard. The reward amounts for different types of vulnerabilities are:
🚨 Critical (CVSS 9.0–10.0)
→ $25,000 - $50,000
⚠️ Major (CVSS 7.0–8.9)
→ $5,000 - $25,000
⚡ Medium (CVSS 4.0–6.9)
→ $500 - $5,000
🐛 Low (CVSS 1.0–3.9)
→ $100 - $500
Rewards will be awarded at the sole discretion of Liquity AG. The quality of the report and reproduction instructions can impact the reward. Rewards are denominated and paid out in USD. If both parties agree, rewards can also be paid out in crypto.
For this initial bug bounty program, there is a maximum bounty pool of $50,000.
The bug bounty program is ongoing and has been running since October 6th, 2022.
Reporting a Vulnerability
Please responsibly disclose any findings to the development team, following these instructions:
In order to report a vulnerability, please write an email to security@liquity.org with [SECURITY DISCLOSURE] in the subject of the email.
For sensitive vulnerabilities, please encrypt the email using this PGP key (Fingerprint: D4BA B0E7 3B99 4FC5 79DC 9E0A C640 0C72 C5B8 CA28).
We will make our best effort to reply in a timely manner and provide a timeline for resolution.
Please include a detailed report on the vulnerability with clear reproduction steps. The quality of the report can impact the reward amount.
Failure to do so will result in a finding being ineligible for any bounties.
Scope
In scope for the bug bounty are all the smart contract components of the Liquity protocol. They can be found in the following repositories:
Solidity code under the LUSDChickenBonds/src directory:
Excluding
LUSDChickenBonds/src/ExternalContractsExcluding
LUSDChickenBonds/src/test
Out of scope
Any frontend applications or client-side code interacting with the contracts, as well as testing code.
Mismatch of the functionality of the contracts and outdated spec documents.
Areas of interest
These are some examples of vulnerabilities that would be interesting:
Stealing tokens or manipulating the token generation process.
Locking or freezing any of the ChickenBond contracts.
Griefing attacks: is it possible to block Chicken In, Chicken Out, redemptions, etc?
Flash loan exploits
Resources
Eligibility
Terms for eligible bounties:
Only unknown vulnerabilities will be awarded a bounty; in case of duplicate reports, the first report will be awarded the bounty.
Public disclosure of the vulnerability, before explicit consent from Liquity AG to do so, will make the vulnerability ineligible for a bounty.
Attempting to exploit the vulnerability in a public Ethereum network will also make it ineligible for a bounty.
Last updated