Dexalot is a revolutionary non-custodial central limit order book dex aiming at bringing the traditional centralized exchange look and feel, through a decentralized on-chain application.
In Scope
| Target | Type | Severity | Reward |
|---|---|---|---|
https://github.com/Dexalot/contracts |
Smart Contract | Critical | Bounty |
IN-SCOPE - SMART CONTRACT VULNERABILITIES
The list is not limited to the following submissions but it gives an overview of what issues we care about:
- Stealing or loss of funds
- Unauthorized transaction
- Transaction manipulation
- Attacks on logic (behavior of the code is different from the business description)
- Reentrancy
- Reordering
- Over and underflows
OUT OF SCOPE - SMART CONTRACT VULNERABILITIES
- Theoretical vulnerabilities without any proof or demonstration
- Old compiler version
- The compiler version is not locked
- Vulnerabilities in imported contracts
- Code style guide violations
- Redundant code
- Gas optimizations
- Best practice issues
- Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
- Make every effort not to damage or restrict the availability of products, services, or infrastructure
- Avoid compromising any personal data, interruption, or degradation of any service
- Don’t access or modify other user data, localize all tests to your accounts
- Perform testing only within the scope
- Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
- Don’t spam forms or account creation flows using automated scanners
- In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
- Don’t break any law and stay in the defined scope
- Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
- Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
- No vulnerability disclosure, including partial is allowed for the moment.
- Please do NOT publish/discuss bugs
We are grateful to everyone that submits valid and help reports, but please keep in mind that only those that meet the following eligibility requirements can receive monetary rewards:
- You must be the first reporter of a vulnerability.
- The vulnerability must be a qualifying vulnerability
- Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
- You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
- You are not a former/current employee nor a contractor of the project.
- ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
- Provide detailed but to-the point reproduction steps