Valuit DualDefense Audit: Program Info

At Valuit, we are dedicated to building an equitable ecosystem by harnessing our deep expertise in compliance, capital markets, and blockchain technology. Our commitment to excellence is reflected in our growing team of professionals, who bring specialized knowledge from partner organizations and our offices around the world.

In scope

Target	Type	Severity	Reward
https://github.com/valuit-official/valuit-smart-contracts/tree/eb1bb6f95b1d5e10b2b012572a36961c0131e214 Copy Copied	Smart Contract	Critical	Bounty

Target

https://github.com/valuit-official/valuit-smart-contracts/tree/eb1bb6f95b1d5e10b2b012572a36961c0131e214

Copied

TypeSmart Contract

Severity

Critical

RewardBounty

Focus Area

IN-SCOPE: SMART CONTRACT VULNERABILITIES

We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality:

Stealing or loss of end-user funds
Permanent lock of end-user funds

OUT OF SCOPE: SMART CONTRACT VULNERABILITIES

Theoretical vulnerabilities without any proof or demonstration
Old compiler version
The compiler version is not locked
Vulnerabilities in imported contracts
Code style guide violations
Redundant code
Gas optimizations
Best practice issues
Known issues on GitHub issue tracker
Known issues in README.md
Front-run attacks
All other issues not mentioned “IN SCOPE” area

Program Rules

Only critical vulnerabilities that could lead to the loss of user funds or the permanent lock of funds are eligible for rewards.

The company is not obliged to pay for "Low"-"High" severity issues. Only "Critical" issues are under the scope. However, the team may, at its discretion, accept the report and pay the bonus, the reward will not be a part of the bounty pool.
Perform testing only within the scope
Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
Each submission requires a working PoC to be eligible for a bounty

Reward Distribution:

The reward will be distributed in HAI tokens. For that you will need to provide in your account your hAI wallet address so we can arrange the transaction.
2,600,000HAI tokens allocated for Critical issue in this contest.
400,000HAI will be taken as a triage fee

Clear wording:

Bounty pool — total amount of reward in the DualDefence Audit.
Allocated bounty — amount of reward for each unique vulnerability reported.
The total bounty pool for the DualDefence Audit will be equally split among all unique issues reported.
Example: If three researchers identify the same vulnerability and also there are two other vulnerabilities submitted only once (total 3 unique issues reported) each vulnerability will get 1/3 of the bounty pool. Allocated bounty reward will be split between all researchers who submitted the same issue (where uniq issues receive 1/3 of the pool and researchers will get 1/9 each of the initial reward pool).

Allocated bounty reward will be split between all researchers who submitted the same issue (where uniq issues receive 1/3 of the pool and researchers will get 1/9 each of the initial reward pool).

Single Valid Submission

Full Reward: If a critical vulnerability is found by only one participant, that reporter receives 100% of the bounty pool.

Duplicate Submissions

If multiple participants find the same vulnerability, the allocated bounty for that issue (bounty pool always equally split among all unique issues reported) is divided equally among all reporters. Example: If two researchers report the same vulnerability, each receives 50% of the allocated bounty. It can be 50% of the bounty pool if only one eligible issue was reported.

Multiple Unique Submissions

Split Based on Uniqueness of issues reported:

Unique Issue 1: Found by one reporter.
Unique Issue 2: Found by another reporter.

Each will receive 50% of the bounty pool.

[DISCLAIMER] The reward amount will be denominated in HAI tokens which are staked in FlashPool, due to market volatility, the final USD amount may differ from the one stated in the rules.

Disclosure Guidelines

Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization

No vulnerability disclosure, including partial is allowed till the end of FlashBounty Audit contest.
Please do NOT publish/discuss bugs

Eligibility and Coordinated Disclosure

We are happy to thank everyone who submits valid reports which help us improve our security. However, only those that meet the following eligibility requirements may receive a monetary reward:

The vulnerability must be a qualifying vulnerability
Any vulnerability found must be reported exclusively through hackenproof.com
You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
You must not be a former or current employee of us or one of its contractor.
Provide detailed but to-the point reproduction steps

Last audit

Hacken - February 2025

Assets in Scope

compliance
 modular
	IModularCompliance.sol - compliance/modular/IModularCompliance.sol
	MCStorage.sol - compliance/modular/MCStorage.sol
	ModularCompliance.sol - compliance/modular/ModularCompliance.sol
	
  modules
		AbstractModuleUpgradeable.sol - compliance/modular/modules/AbstractModuleUpgradeable.sol
		CountryAllowModule.sol - compliance/modular/modules/CountryAllowModule.sol
		HoldTimeModule.sol - compliance/modular/modules/HoldTimeModule.sol
		IModule.sol - compliance/modular/modules/IModule.sol
		MaxBalanceModule.sol - compliance/modular/modules/MaxBalanceModule.sol
		ModuleProxy.sol - compliance/modular/modules/ModuleProxy.sol
		SupplyLimitModule.sol - compliance/modular/modules/SupplyLimitModule.sol
		AbstractModule.sol - compliance/modular/modules/AbstractModule.sol
		CountryRestrictModule.sol - compliance/modular/modules/CountryRestrictModule.sol
		
escrow
	Escrow.sol - escrow/Escrow.sol
	EscrowStorage.sol - escrow/EscrowStorage.sol
	TransferHelper.sol - escrow/TransferHelper.sol
	EscrowController.sol - escrow/EscrowController.sol
	EscrowControllerProxy.sol - escrow/EscrowControllerProxy.sol

factory
	FactoryProxy.sol - factory/FactoryProxy.sol
	FundFactory.sol - factory/FundFactory.sol
	FundFactoryStorage.sol - factory/FundFactoryStorage.sol
	ITREXFactory.sol - factory/ITREXFactory.sol
	TREXFactory.sol - factory/TREXFactory.sol
	IFundFactory.sol - factory/IFundFactory.sol
	
fund
	EquityConfig.sol - fund/EquityConfig.sol
	EquityConfigStorage.sol - fund/EquityConfigStorage.sol
	Fund.sol - fund/Fund.sol
	FundStorage.sol - fund/FundStorage.sol
	IFactory.sol - fund/IFactory.sol
	IFund.sol - fund/IFund.sol
	ITKN.sol - fund/ITKN.sol
	
Helpers
	Bytes.sol - Helpers/Bytes.sol
	String.sol - Helpers/String.sol
	
onchainID
 factory
	IdFactory.sol - onchainID/factory/IdFactory.sol
	IIdFactory.sol - onchainID/factory/IIdFactory.sol
Identity.sol - onchainID/Identity.sol

 interface
	IClaimIssuer.sol - onchainID/interface/IClaimIssuer.sol
	IERC734.sol - onchainID/interface/IERC734.sol
	IERC735.sol - onchainID/interface/IERC735.sol
	IIdentity.sol - onchainID/interface/IIdentity.sol
	IImplementationAuthority.sol - onchainID/interface/IImplementationAuthority.sol
	
 proxy
	IdentityProxy.sol - onchainID/proxy/IdentityProxy.sol
	ImplementationAuthority.sol - onchainID/proxy/ImplementationAuthority.sol

 storage
	Storage.sol - onchainID/storage/Storage.sol
	Structs.sol - onchainID/storage/Structs.sol
	
 version
	Version.sol - onchainID/version/Version.sol
	ClaimIssuer.sol - onchainID/ClaimIssuer.sol

 verifiers
	Verifier.sol - onchainID/verifiers/Verifier.sol

 proxy
	AbstractProxy.sol - proxy/AbstractProxy.sol

 authority
	IAFactory.sol - proxy/authority/IAFactory.sol
	IIAFactory.sol - proxy/authority/IIAFactory.sol
	ITREXImplementationAuthority.sol - proxy/authority/ITREXImplementationAuthority.sol
	TREXImplementationAuthority.sol - proxy/authority/TREXImplementationAuthority.sol
	ClaimTopicsRegistryProxy.sol - proxy/ClaimTopicsRegistryProxy.sol
	IdentityRegistryProxy.sol - proxy/IdentityRegistryProxy.sol
	IdentityRegistryStorageProxy.sol - proxy/IdentityRegistryStorageProxy.sol
	
 interface
	IImplementationAuthority.sol - proxy/interface/IImplementationAuthority.sol
	IProxy.sol - proxy/interface/IProxy.sol
	ModularComplianceProxy.sol - proxy/ModularComplianceProxy.sol
	ProxyV1.sol - proxy/ProxyV1.sol
	TokenProxy.sol - proxy/TokenProxy.sol
	TrustedIssuersRegistryProxy.sol - proxy/TrustedIssuersRegistryProxy.sol
	

registry
  implementation
		ClaimTopicsRegistry.sol - registry/implementation/ClaimTopicsRegistry.sol
		IdentityRegistry.sol - registry/implementation/IdentityRegistry.sol
		IdentityRegistryStorage.sol - registry/implementation/IdentityRegistryStorage.sol
		TrustedIssuersRegistry.sol - registry/implementation/TrustedIssuersRegistry.sol
  interface
		IClaimTopicsRegistry.sol - registry/interface/IClaimTopicsRegistry.sol
		IIdentityRegistry.sol - registry/interface/IIdentityRegistry.sol
		IIdentityRegistryStorage.sol - registry/interface/IIdentityRegistryStorage.sol
		ITrustedIssuersRegistry.sol - registry/interface/ITrustedIssuersRegistry.sol
  storage
		CTRStorage.sol - registry/storage/CTRStorage.sol
		IRSStorage.sol - registry/storage/IRSStorage.sol
		IRStorage.sol - registry/storage/IRStorage.sol
		TIRStorage.sol - registry/storage/TIRStorage.sol

 roles
	AgentRole.sol - roles/AgentRole.sol
	AgentRoleUpgradeable.sol - roles/AgentRoleUpgradeable.sol
	Roles.sol - roles/Roles.sol

 token
	IToken.sol - token/IToken.sol
	Token.sol - token/Token.sol
	TokenStorage.sol - token/TokenStorage.sol
	VERC20.sol - token/VERC20.sol

 wrapper
	Wrapper.sol - wrapper/Wrapper.sol
	WrapperStorage.sol - wrapper/WrapperStorage.sol
	WrapperProxy.sol - wrapper/WrapperProxy.sol

Valuit DualDefense Audit: Program info