ADI Foundation Smart Contracts: Program info

IN SCOPE VULNERABILITIES

We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality. Examples include (but aren’t limited to):

• Theft or permanent loss of funds (direct or via fee/interest/accounting bugs)
• Unauthorized actions: bypassing access control
• Transaction ordering assumptions where state can be corrupted or assets stolen when calls are reordered by an adversary (not simple MEV PnL; must break invariants)
• Attacks on logic (behavior of the code is different from the business description)
• Upgradeable proxy misconfig (wrong impl slot, delegatecall hazards, unsafe UUPS/Beacon usage)
• Admin/key/guardian logic that allows unintended upgrades, self-destructs, or parameter changes that bypass intended checks
• Finalization or message processing without a valid verifier result due to miswiring (e.g., contract never calls the verifier, ignores boolean return, or binds wrong inputs around the call)
• Reentrancy
• Over and underflows
• Balance manipulation
• Contracts execution flows

Please, use only zkos-v0.29.11 tag version of the source code. Report from any other source code version would be rejected.

OUT OF SCOPE VULNERABILITIES

• Theoretical vulnerabilities without any proof or demonstration
• Compiler concerns: “old version” or “pragma not pinned” without an exploit
• Vulnerabilities in imported contracts
• Style, redundancy, best practices, gas/packing optimizations
• Best practice issues
• Front-run/MEV-only profit scenarios that do not break invariants or cause loss/theft
• Attacks that rely on social engineering
• zkProof verification algorithm (it's a part of another bounty program)
• Public Zero-day vulnerabilities
• Vendor-specific or third-party modules not maintained by ADI Foundation, including but not limited to Matter Labs libraries or any components delivered by external vendors that are:
  • Not part of the officially tagged source code repositories specified in scope
  • Not under ADI Foundation’s direct maintenance or review process
• Reason: The program only intends to cover code under direct project control; vulnerabilities in third-party vendor libraries should be raised with the respective vendor bounty program or governance.
Example: the zkProof verification algorithm is out of scope because it belongs to another bounty program.
• Imported contracts or dependencies not written by the core ADI team unless:
  • They are modified and part of the deployed on-chain ABI targeted in scope
  • They are explicitly mentioned in our in-scope targets
• Vulnerabilities that are shared with vendor-maintained code (e.g., Matter Labs) and were already fixed in the vendor’s public codebase prior to report submission are out of scope, regardless of whether the fix had been deployed to ADI Foundation contracts at that time.

• Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Don’t access or modify other user data, localize all tests to your accounts
• Perform testing only within the scope
• Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
• Don’t spam forms or account creation flows using automated scanners
• In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
• Don’t break any law and stay in the defined scope
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial is allowed for the moment.
• Please do NOT publish/discuss bugs

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of us or one of its contractor.
• ONLY USE the EMAIL under which you registered your HackenProof account (in case of violation, no bounty can be awarded)
• Provide detailed but to-the point reproduction steps