Kinetic is here to kickstart De-Fi and guide the Flare ecosystem into its next stage of explosive growth. We want to inspire you to activate your assets, whether they are traditional (ERC20) or non-traditional (FAssets), and turn their latent potential into progress. Through the tooling provided by Kinetic, you can develop and employ advanced financial strategies with long-term benefits. We are an ecosystem-tailored money market enhanced with an optional work-to-earn element through Kii Stake.

In scope

Target	Type	Severity	Reward
https://github.com/kinetic-market/public-money-market-contracts Copy Copied Commit: b32284b26eeb159f6d6a66b35b920b003279280b	Smart Contract	Critical	Bounty

Target

https://github.com/kinetic-market/public-money-market-contracts

Copied

Commit: b32284b26eeb159f6d6a66b35b920b003279280b

TypeSmart Contract

Severity

Critical

RewardBounty

Focus Area

IN-SCOPE VULNERABILITIES

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Any governance voting result manipulation
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Permanent freezing of funds
Insolvency
Theft of unclaimed yield
Permanent freezing of unclaimed yield
Temporary freezing of funds
Smart contract unable to operate due to lack of funds
Block stuffing for profit
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Theft of gas
Unbounded gas consumption
Smart contract fails to deliver promised returns, but doesn’t lose value
Functional correctness of implementation even if it's not directly impacting user funds
Best practices, architectural flaws and other types of issues are included at discretion of Kinetic's team.

OUT OF SCOPE

Incorrect data supplied by third party oracles
Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Sybil attacks
Centralization risks

Program Rules

The following activities are prohibited by this contest event:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against Kinetic employees and/or customers
Any denial of service attacks
Public disclosure of an unpatched vulnerability in an embargoed bounty
Make every effort not to damage or restrict the availability of products, services, or infrastructure
Avoid compromising any personal data, interruption, or degradation of any service
Localize all tests to your accounts
Perform testing only within the scope
In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of Kinetic Company without appropriate permission

Discussion

We use Discord as official communication channel: https://discord.gg/D9hMnGEZ Join the channel, and create #support ticket to be added for conversation.

Disclosure Guidelines

Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
No vulnerability disclosure, including partial is allowed for the moment.
Please do NOT publish/discuss bugs

Eligibility and Coordinated Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

The vulnerability must be a qualifying vulnerability
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
You must not be a former or current employee of us or one of its contractor.
Provide detailed but to-the point reproduction steps

In-Scope Contracts

money-market-contracts: File: Tokenomics/RedeemBurnRateCalculatorV3.sol File: Governance/ProtocolToken.sol File: Tokenomics/esProtocol.sol File: Tokenomics/UniV3Oracle.sol File: PauseGuardian.sol File: Unitroller.sol File: ComptrollerV2.sol File: ComptrollerLib.sol File: AllowList.sol File: FTSO/ProtocolFTSOV2Oracle.sol File: FTSO/sETH.sol File: FTSO/sNative.sol File: Tokenomics/rewards/CTokenRewards.sol File: CErc20Delegator.sol File: CErc20Delegate.sol File: JumpRateModel.sol File: Lens.sol liquidator-contracts: File: UniswapV3Liquidator.sol

Missed dependencies (included)

money-market-contracts: File: Comptroller.sol File: CErc20.sol File: Tokenomics/esProtocolStorage.sol File: Exponential.sol File: PriceOracle.sol File: CToken.sol File: ExponentialNoError.sol File: SafeMath.sol File: ErrorReporter.sol File: PriceOracleV2.sol File: CarefulMath.sol File: InterestRateModel.sol File: ComptrollerStorage.sol File: OverridablePriceOracle.sol

File: Exponential-0.8.sol File: Governance/ProtocolTokenStorage.sol File: Tokenomics/rewards/CTokenRewardsStorage.sol File: OpenZeppelin/Ownable.sol File: OpenZeppelin/SafeERC20.sol File: OpenZeppelin/Address.sol File: OpenZeppelin/Ownable2Step.sol liquidator-contracts: File: BaseLiquidator.sol File: forge/Path.sol File: forge/ForgeLibrary.sol File: forge/BytesLib.sol

Interfaces money-market-contracts: File: ComptrollerInterface.sol File: EIP20NonStandardInterface.sol File: EIP20Interface.sol File: FTSO/IFTSOV2.sol File: FTSO/IExchangeableAsset.sol File: Tokenomics/IAllowlist.sol File: Tokenomics/IRedeemBurnRateCalculator.sol File: CTokenInterfaces.sol

liquidator-contracts: File: IWETH.sol File: moneyMarket/EIP20NonStandardInterface.sol File: moneyMarket/ComptrollerInterface.sol File: moneyMarket/PriceOracle.sol File: moneyMarket/InterestRateModel.sol File: moneyMarket/CTokenInterfaces.sol File: pangolin/ICallee.sol File: pangolin/IPangolinFactory.sol File: pangolin/IPangolinPair.sol File: forge/IUniswapV3Factory.sol File: forge/ICallee.sol File: forge/IUniswapV3Pool.sol File: forge/ISwapRouter.sol File: forge/IEnosysDexV3.sol File: equilibre/IPairFactory.sol File: equilibre/IPairCallee.sol File: equilibre/IPair.sol

Rewards Distribution

40% for critical issues
30% for high issues
15% for medium issues
5% gas optimization issues, best practices

Read more: https://docs.hackenproof.com/

Kinetic Audit Contest: Program info