Voltz Bug Bounty
Alongside third-party auditors we want help from the community in ensuring Voltz Protocol remains secure. As a result, we have a generous bug-bounty program on Immunifi. We look forward to your help in creating one of the most important lego-blocks of a new financial system!
The bug bounty program is limited to the issues and vulnerabilities that have an effect on Voltz Protocol.
- Logic Errors
- Integer Overflow/Underflow
- Composability Vulnerabilities
- Interest Rate Oracle manipulation
- Susceptibility to block timestamp manipulation
- DDOS attacks
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance)
- Lack of liquidity
- Best practice critiques
- It is critical to proactively aim to cause no issues to the UX of the protocol and/or interfere with Voltz Protocol contract deployments
- It is critical to not disclose vulnerabilities post discovery until finalizing iterations/resolution with the team
- The bug reports should only be done via the Immunefi UI
- A reporter cannot be one of our current or former team members, vendors, contractors or an employee of any of those contractors or vendors
- Report a single vulnerability per submission, unless it is necessary to chain vulnerabilities to provide context regarding any of the issues
Following is not allowed in the scope of the programme:
- Any testing with mainnet or public testnet contracts; all testing should be done in private development environments
- Attempting phishing or other social engineering attacks against our team
- Any testing that involves third party applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
The decisions regarding the reward payouts are made by our team. The terms of the program may change as the protocol and DAO evolves.