Metis Smart Contracts: Program info

• All smart contracts of Metis can be found at https://github.com/MetisProtocol/mvm/tree/develop/packages/contracts/contracts. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
• All smart contracts bug reports must come with a PoC in order to be considered for a reward.
• Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of USD 30 000 for Critical bug reports.
• Metis requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is the name, email address, phone number, company name (if applicable), and physical address.
• Payouts are handled by the Metis team directly and are denominated in USD. However, payouts are done in METIS.

IN-SCOPE: SMART CONTRACT VULNERABILITIES

• We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality:
• Stealing or loss of funds
• Unauthorized transaction
• Transaction manipulation
• Attacks on logic (behavior of the code is different from the business description)
• Reentrancy
• Reordering
• Over and underflows

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contract:

• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - Critical
• Permanent freezing of funds - Critical
• Protocol Insolvency - Critical
• Temporary freezing of funds - High
• Smart contract unable to operate due to lack of token funds - Medium
• Block stuffing for profit - Medium
• Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - Medium
• Theft of gas - Medium
• Unbounded gas consumption - Medium
• Contract fails to deliver promised returns, but doesn't lose value - Low

OUT OF SCOPE: SMART CONTRACT VULNERABILITIES

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage Attacks requiring access to leaked keys/credentials Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain:

• Incorrect data supplied by third party oracles
• Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Theoretical vulnerabilities without any proof or demonstration
• Old compiler version
• The compiler version is not locked
• Vulnerabilities in imported contracts
• Code style guide violations
• Redundant code
• Gas optimizations

• Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Don’t access or modify other user data, localize all tests to your accounts
• Perform testing only within the scope
• Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam
• Don’t spam forms or account creation flows using automated scanners
• In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
• Don’t break any law and stay in the defined scope
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial is allowed for the moment.
• Please do NOT publish/discuss bugs

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of us or one of its contractor.
• ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
• Provide detailed but to-the point reproduction steps