Alongside third-party auditors we want help from the community in ensuring Voltz Protocol remains secure. As a result, we have a generous bug-bounty program on Immunifi. We look forward to your help in creating one of the most important lego-blocks of a new financial system!
Smart Contract Scope
The bug bounty program is limited to the issues and vulnerabilities that have an effect on Voltz Protocol.
Vulnerabilities that fall into the below categories are of particular interest to us:
Re-entrancy
Logic Errors
Integer Overflow/Underflow
Composability Vulnerabilities
Interest Rate Oracle manipulation
Susceptibility to block timestamp manipulation
Vulnerabilities that are excluded from the programme are:
DDOS attacks
Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance)
Lack of liquidity
Best practice critiques
Reward Table
Severity Level
USD Amount
Impacts Covered
Critical
$100,000
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Permanent freezing of funds
High
$15,000
Insolvency
Theft of unclaimed yield
Permanent freezing of unclaimed yield
Medium
$5,000
Smart contract unable to operate due to lack of funds
Block stuffing for profit
Theft of gas
Unbounded gas consumption (gas drainage)
Low
$1,000
Smart contract fails to deliver promised returns, but doesn’t lose value
Reporting Guidelines
It is critical to proactively aim to cause no issues to the UX of the protocol and/or interfere with Voltz Protocol contract deployments
It is critical to not disclose vulnerabilities post discovery until finalizing iterations/resolution with the team
The bug reports should only be done via the Immunefi UI
A reporter cannot be one of our current or former team members, vendors, contractors or an employee of any of those contractors or vendors
Report a single vulnerability per submission, unless it is necessary to chain vulnerabilities to provide context regarding any of the issues
Disclosures
Following is not allowed in the scope of the programme:
Any testing with mainnet or public testnet contracts; all testing should be done in private development environments
Attempting phishing or other social engineering attacks against our team
Any testing that involves third party applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Other terms
The decisions regarding the reward payouts are made by our team. The terms of the program may change as the protocol and DAO evolves.