LiNEAR Protocol: Program info

IN SCOPE VULNERABILITIES (Blockchain Protocol)

We are especially interested in receiving and rewarding vulnerabilities of the following types.

• Re-entrancy
• Logic errors (including authentification errors)
• Trusting trust/dependency vulnerabilities (including composability vulnerabilities)
• Novel governance attacks
• Economic/financial attacks
• Congestion and scalability (including running out of gas, block stuffing and susceptibility to frontrunning)
• Cryptography problems (including susceptibility to replay attacks, weak encryption)
• Susceptibility to block timestamp manipulation
• Missing access controls / unprotected internal or debugging interfaces

OUT OF SCOPE VULNERABILITIES (Blockchain Protocol)

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Sybil attacks

The following activities are prohibited by this bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty

• Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Don’t access or modify other user data, localize all tests to your accounts
• Perform testing only within the scope
• Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
• Don’t spam forms or account creation flows using automated scanners
• In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
• Don’t break any law and stay in the defined scope
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of us or one of its contractor.
• ONLY USE the EMAIL under which you registered your HackenProof account (in case of violation, no bounty can be awarded)
• Provide detailed but to-the point reproduction steps

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial is allowed for the moment.
• Please do NOT publish/discuss bugs

Bounties will be distributed according to the impact of the vulnerability. In order to assess the vulnerabilities, we use the following vulnerability severity levels. This is a simplified 5-level scale encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit:

• Critical
• High
• Medium
• Low
• Note

Examples:

• A bug causing loss of funds is more severe than one preventing token transfers.
• A bug any token holder can trigger is more severe than one requiring a rogue oracle.
• A bug triggered by a third party is more severe than one requiring the affected token holder to act.

Below mainly focuses on exploit consequences, but bugs may be downgraded if elevated privileges or uncommon interactions are required.

Critical

• Empty or freeze the contract's holdings
• Cryptographic flaws

High

• Token holders temporarily unable to transfer holdings
• Users spoof each other
• Theft of yield
• Transient consensus failures

Medium

• Contract consumes unbounded gas
• Block stuffing
• Griefing denial of service (i.e. attacker spends as much in gas as damage to the contract)
• Gas griefing

Low

• Contract fails to deliver promised returns, but doesn't lose value

Note

• Best practices

Critical: Up to 5,000 USD (minimul 3,000 USD) High: Up to 3,000 USD (minimum 2,000 USD) Medium: Up to 2,000 USD Low: Up to 500 USD Note: Up to 100 USD

Payouts are handled by the LiNEAR team directly and are denominated in USD. Payouts can be done in USDT, LiNEAR and LNR, at the decision of the LiNEAR team.