Bug Bounty Program

Bug Bounty program for Pact ecosystem

Overview

The program covers Pact's Smart Contracts and Frontend / Backend vulnerabilities.

Rewards

Severity

Payout

Scope

All smart contract in our Github repo are in scope. You can find them deployed on MainNet by checking our pools at https://app.pact.fi. PyTeal source code will be released in Q2/Q3 2022.

Our web app (https://app.pact.fi) and API (https://api.pact.fi) are also in scope.

Severity Classification

Bug bounty program use the Immunefi Vulnerability Severity Classification System with following exceptions. All critical payments, both for smart contracts and the website, are capped at 10% of economic damage.

Web vulnerabilities in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Pact interface.

Out of Scope & Rules

All programs

Attacks that the reporter has already exploited himself, leading to damage
Attacks that rely on social engineering
Attacks requiring access to leaked keys/credentials
Attacks already reported or published

Smart Contracts/Blockchain

Incorrect data supplied by third party oracles/exchange rate being outdated
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Loss of positive slippage through Sandwich Attacks
Lack of liquidity
Best practice critiques
Sybil attacks

Websites and Apps

Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope

The following activities are prohibited by bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty

Reporting

Email bugbounty@pact.fi with detailed description of the attack. All bug reports must come with a proof of concept.

PreviousSecurity Overview NextAMA Archive

Last updated 2 years ago

Severity

Payout

Severity Classification

Web vulnerabilities in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Pact interface.

Out of Scope & Rules

All programs

Attacks that the reporter has already exploited himself, leading to damage

Attacks that rely on social engineering

Attacks requiring access to leaked keys/credentials

Attacks already reported or published

Smart Contracts/Blockchain

Incorrect data supplied by third party oracles/exchange rate being outdated

Not to exclude oracle manipulation/flash loan attacks

Basic economic governance attacks (e.g. 51% attack)

Loss of positive slippage through Sandwich Attacks

Lack of liquidity

Best practice critiques

Sybil attacks

Websites and Apps

Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope

The following activities are prohibited by bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets

Any testing with pricing oracles or third party smart contracts

Attempting phishing or other social engineering attacks against our employees and/or customers

Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)

Any denial of service attacks

Automated testing of services that generates significant amounts of traffic

Public disclosure of an unpatched vulnerability in an embargoed bounty