Router is a cross chain liquidity infrastructure primitive that aims to seamlessly provide bridging infra between various current and emerging layer-1 and layer-2 blockchain solutions, such as Matic and Ethereum.
In Scope
| Target | Type | Severity | Reward |
|---|---|---|---|
| Protocol | Critical | Bounty | |
| Protocol | Critical | Bounty | |
| Protocol | Critical | Bounty | |
| Protocol | Critical | Bounty | |
BSC HandlerReservehttps://bscscan.com/address/0x6e14f48576265272B6CAA3A7cC500a26050Be64E |
Protocol | Critical | Bounty |
Polygon Mainnet Voterhttps://polygonscan.com/address/0x2D7D5f298067E81e8827eB686428881f4c988dC1 |
Protocol | Critical | Bounty |
Smart Contract: Polygon Mainnet Bridgehttps://polygonscan.com/address/0xf18aCC02628009231d7BAAF9a7a24C0860Dda6cb |
Protocol | Critical | Bounty |
Polygon Mainnet ERC20Handlerhttps://polygonscan.com/address/0x00b8F3E184e5DaAadB8fdA995bbabBCC1b35Ae93 |
Protocol | Critical | Bounty |
Polygon Mainnet Feemanagerhttps://polygonscan.com/address/0xA63f3147C6bAE70A53a30e30421b1a992e60Aac2 |
Protocol | Critical | Bounty |
Polygon Mainnet HandlerReservehttps://polygonscan.com/address/0x6e14f48576265272B6CAA3A7cC500a26050Be64E |
Protocol | Critical | Bounty |
Smart Contract - Smart Contract: Polygon Stakinghttps://polygonscan.com/address/0x2B91D8a547D5F5E070d18208427E0C2F56335CF0 |
Protocol | Critical | Bounty |
Smart Contract - Smart Contract: Polygon Router SDKhttps://polygonscan.com/address/0xa526Cc7B3a12E2edbaf81471191900Ca9D37B3d9 |
Protocol | Critical | Bounty |
Smart Contract IN SCOPE
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
- Any governance voting result manipulation
- Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
- Miner-extractable value (MEV)
- Permanent freezing of funds
- Protocol Insolvency
- Theft of unclaimed yield
- Permanent freezing of unclaimed yield
- Temporary freezing of funds
- Smart contract unable to operate due to lack of token funds
- Block stuffing for profit
- Theft of gas
- Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
- Unbounded gas consumption
- Contract fails to deliver promised returns, but doesn't lose value
Smart Contract OUT OF SCOPE
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist)
Smart Contracts and Blockchain OUT OF SCOPE
- Incorrect data supplied by third party oracles (Not to exclude oracle manipulation/flash loan attacks)
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
- No vulnerability disclosure, including partial, is allowed for the moment.
- Please do NOT publish/discuss bugs
We are happy to thank everyone who submits valid reports, which help us improve the security. However, only those who meet the following eligibility requirements may receive a monetary reward:
- You must be the first vulnerability reporter.
- The vulnerability must be a qualifying vulnerability
- Any vulnerability found must be reported no later than 24 hours after discovery, and exclusively through hackenproof.com
- You must send a clear textual description of the report along with steps to reproduce the issue, including attachments such as screenshots or proof of concept code as necessary.
- You must not be a former or current employee of us or one of its contractors.
- ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
- Provide detailed but to-the-point reproduction steps