Metis Smart Contracts: Program Info

Triaged by HackenProof
Metis

Metis is a permissionless Layer 2 network powering the next generation of decentralized applications.

In Scope

Target Type Severity Reward
https://etherscan.io/address/0xf51B9C9a1c12e7E48BEC15DC358D0C1f0d7Eb3be

Smart Contract - BondManager

Smart Contract Critical Bounty
https://etherscan.io/address/0x56a76bcC92361f6DF8D75476feD8843EdC70e1C9

Smart Contract - CanonicalTransactionChain

Smart Contract Critical Bounty
https://etherscan.io/address/0x38473Feb3A6366757A249dB2cA4fBB2C663416B7

Smart Contract - ChainStorageContainer-CTC-batches

Smart Contract Critical Bounty
https://etherscan.io/address/0xA91Ea6F5d1EDA8e6686639d6C88b309cF35D2E57

Smart Contract - ChainStorageContainer-CTC-queue

Smart Contract Critical Bounty
https://etherscan.io/address/0x10739F09f6e62689c0aA8A1878816de9e166d6f9

Smart Contract - ChainStorageContainer-SCC-batches

Smart Contract Critical Bounty
https://etherscan.io/address/0x101500214981e7A5Ad2334D8404eaF365C2c3113

Smart Contract - L1StandardBridgeforverification_only

Smart Contract Critical Bounty
https://etherscan.io/address/0x918778e825747a892b17C66fe7D24C618262867d

Smart Contract - AddressManager

Smart Contract Critical Bounty
https://etherscan.io/address/0xC8953ca384b4AdC8B1b11B030Afe2F05471664b0

Smart Contract - MVM_DiscountOracle

Smart Contract Critical Bounty
https://etherscan.io/address/0x9E2E3be85df5Ca63DE7674BA64ffD564075f3B48

Smart Contract - MVML2ChainManagerOnL1forverificationonly

Smart Contract Critical Bounty
https://etherscan.io/address/0x8bf439ef7167023f009e24b21719ca5f768ecb36

Smart Contract - OVM_L1CrossDomainMessenger

Smart Contract Critical Bounty
https://etherscan.io/address/0xf3d58D1794f2634d6649a978f2dc093898FEEBc0

Smart Contract - Proxy_OVML1CrossDomainMessenger

Smart Contract Critical Bounty
https://etherscan.io/address/0x081D1101855bD523bA69A9794e0217F0DB6323ff

Smart Contract - Proxy_OVML1CrossDomainMessenger

Smart Contract Critical Bounty
https://etherscan.io/address/0x3980c9ed79d2c191A89E02Fa3529C60eD6e9c04b

Smart Contract - Proxy_OVML1StandardBridge

Smart Contract Critical Bounty
https://etherscan.io/address/0xf209815E595Cdf3ed0aAF9665b1772e608AB9380

Smart Contract - StateCommitmentChain

Smart Contract Critical Bounty
  • All smart contracts of Metis can be found at https://github.com/MetisProtocol/mvm/tree/develop/packages/contracts/contracts. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
  • All smart contracts bug reports must come with a PoC in order to be considered for a reward.
  • Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of USD 30 000 for Critical bug reports.
  • Metis requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is the name, email address, phone number, company name (if applicable), and physical address.
  • Payouts are handled by the Metis team directly and are denominated in USD. However, payouts are done in METIS.

IN-SCOPE: SMART CONTRACT VULNERABILITIES

  • We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality:
  • Stealing or loss of funds
  • Unauthorized transaction
  • Transaction manipulation
  • Attacks on logic (behavior of the code is different from the business description)
  • Reentrancy
  • Reordering
  • Over and underflows

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contract:

  • Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - Critical
  • Permanent freezing of funds - Critical
  • Protocol Insolvency - Critical
  • Temporary freezing of funds - High
  • Smart contract unable to operate due to lack of token funds - Medium
  • Block stuffing for profit - Medium
  • Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - Medium
  • Theft of gas - Medium
  • Unbounded gas consumption - Medium
  • Contract fails to deliver promised returns, but doesn't lose value - Low

OUT OF SCOPE: SMART CONTRACT VULNERABILITIES

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that the reporter has already exploited themselves, leading to damage Attacks requiring access to leaked keys/credentials Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain:

  • Incorrect data supplied by third party oracles
  • Not to exclude oracle manipulation/flash loan attacks
  • Basic economic governance attacks (e.g. 51% attack)
  • Lack of liquidity
  • Best practice critiques
  • Sybil attacks
  • Theoretical vulnerabilities without any proof or demonstration
  • Old compiler version
  • The compiler version is not locked
  • Vulnerabilities in imported contracts
  • Code style guide violations
  • Redundant code
  • Gas optimizations
  • Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
  • Make every effort not to damage or restrict the availability of products, services, or infrastructure
  • Avoid compromising any personal data, interruption, or degradation of any service
  • Don’t access or modify other user data, localize all tests to your accounts
  • Perform testing only within the scope
  • Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
  • Don’t spam forms or account creation flows using automated scanners
  • In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
  • Don’t break any law and stay in the defined scope
  • Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
  • Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
  • No vulnerability disclosure, including partial is allowed for the moment.
  • Please do NOT publish/discuss bugs

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

  • You must be the first reporter of a vulnerability.
  • The vulnerability must be a qualifying vulnerability
  • Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
  • You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
  • You must not be a former or current employee of us or one of its contractor.
  • ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
  • Provide detailed but to-the point reproduction steps