Metis Smart Contracts: Program Info

• All smart contracts of Metis can be found at https://github.com/MetisProtocol/mvm/tree/develop/packages/contracts/contracts. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
• All smart contracts bug reports must come with a PoC in order to be considered for a reward.
• Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of USD 50 000 for Critical bug reports.
• Metis requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is the name, email address, phone number, company name (if applicable), and physical address.
• Payouts are handled by the Metis team directly and are denominated in USD. However, payouts are done in METIS.

IN-SCOPE: SMART CONTRACT VULNERABILITIES

• We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality:
• Stealing or loss of funds
• Unauthorized transaction
• Transaction manipulation
• Attacks on logic (behavior of the code is different from the business description)
• Reentrancy
• Reordering
• Over and underflows

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contract:

• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - Critical
• Permanent freezing of funds - Critical
• Protocol Insolvency - Critical
• Temporary freezing of funds - High
• Smart contract unable to operate due to lack of token funds - Medium
• Block stuffing for profit - Medium
• Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - Medium
• Theft of gas - Medium
• Unbounded gas consumption - Medium
• Contract fails to deliver promised returns, but doesn't lose value - Low

OUT OF SCOPE: SMART CONTRACT VULNERABILITIES

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage Attacks requiring access to leaked keys/credentials Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain:

• Incorrect data supplied by third party oracles
• Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Theoretical vulnerabilities without any proof or demonstration
• Old compiler version
• The compiler version is not locked
• Vulnerabilities in imported contracts
• Code style guide violations
• Redundant code
• Gas optimizations