UniLend V2 Relaunched Bug Bounty On Immunefi

Ana Marie — Fri, 18 Nov 2022 10:13:02 +0000

UniLend V2 Relaunched Bug Bounty On Immunefi

UniLend V2 Relaunched Bug Bounty On Immunefi. The UniLend a comprehensive permissionless DeFi protocol. Whereas other DeFi protocols support only a limited number of assets, anyone can list any asset on UniLend’s supported blockchains (currently Ethereum, Polygon, BSC and Moonriver) to access comprehensive DeFi functionality for those assets. This includes decentralized lending/borrowing, and the industry’s most cost-effective flash loans.

In addition to cryptocurrencies, UniLend will also support various synthetic real-world assets, NFTs and derivatives (including the major FAANG stocks and precious metals such as gold and silver).

This bug bounty program is focus on their smart contracts and is focus on preventing:

Loss of user funds staked (principal) by freezing or theft
Temporary freezing of funds for at least 24 hours
Unable to call smart contract
Smart contract gas drainage
Smart contract fails to deliver promised returns

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Critical and High smart contract bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be consider for a reward. Explanations and statements are not accepted as PoC and code is require. In addition, all Critical and High bug reports must also come with a suggestion for a fix in order to be consider for a reward.

All known issues highlight in the following audit report are consider out of scope:

https://bit.ly/3KPUTOE

Payouts are handled by the Unilend team directly and are denominate in USD. However, payouts are done in UFT.

Out of Scope & Rules

The following vulnerabilities are exclude from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Centralization risks

The following activities are prohibit by this bug bounty program:

Any testing with mainnet or public testnet contracts; all test should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty

About Unilend Finance

UniLend a permissionless DeFi protocol that combines spot trading services and lending/borrowing functionality within the same platform.

Website | Twitter |

About Immunefi

Immunefi the premier bug bounty platform for smart contracts and DeFi projects. Where security researchers review code, disclose vulnerabilities, get pay, and make crypto safer. Immunefi removes security risk through bug bounties and comprehensive security services.

Website | Twitter |

Source

REQUEST AN ARTICLE

The post UniLend V2 Relaunched Bug Bounty On Immunefi appeared first on Smart Liquidity Research.

pSTAKE partners with Immunefi

Mische Martinete — Sat, 06 Aug 2022 03:35:39 +0000

pSTAKE partners with Immunefi to launch a bug bounty program. The pSTAKE is on the path to creating a comprehensive and robust multi-chain liquid staking ecosystem.

pSTAKE aim to have millions of user funds liquid staked via the protocol, security is of the utmost importance for them.

Immunefi is Web3’s leading bug bounty platform (protecting USD100 billion in user funds) through which security researchers, developers, and more can review code and disclose vulnerabilities in smart contract-based applications for compensation.

The bug bounty program covers stkBNB’s smart contracts and apps and is focus on the prevention of loss of user funds, denial of service, governance hijacks, data breaches, and data leaks.

Rewards by Threat Level

Based on the Immunefi Vulnerability Severity Classification System 2 (IVSCS), rewards are distributed according to the impact of the vulnerability.

This is a simplified 5-level scale (separate for websites/apps and smart contracts/blockchains) encompassing all the aspects of a bug, from the consequence of a successful exploit to the level of access required to exploit it, to the probability that an exploitation attempt will be successful.

Smart Contracts and Blockchain*

Critical – USD 25,000 to USD 300,000
Loss of user funds:
📌 10% of assets at risk, minimum USD 50,000 and maximum USD 300,000
Loss of non-user funds (e.g. treasury):
🌠 10% of assets at risk, minimum USD 25,000 and maximum USD 200,000
High – USD 20,000 to USD 100,000
👉🏽 10% of assets at risk, minimum USD 20,000 and maximum USD 100,000
Medium – USD 20,000
Low – USD 1,000

Website and Apps*

Critical – USD 20,000
High – USD 5,000
Medium – USD 2,000
Low – USD 1,000

The numbers mentioned above are tentative and finalizes before launching the bug bounty program. The impacts covered by the bug bounty program & their severities will be updated on the stkBNB Immunefi Bug Bounty Program page.

All smart contracts, and web and app bugs must come with a Proof of Concept (PoC) to be accepted. All such bug reports without a PoC will be rejected with a request to include the PoC.

Payouts handle by the pSTAKE team directly and are denominates in USD. Payouts in PSTAKE, USDC, and BUSD, at the discretion of the pSTAKE protocol.

ABOUT pSTAKE

pSTAKE is a liquid staking protocol unlocking the liquidity of staked assets. Stakers of PoS tokens can now stake their assets while maintaining the liquidity of these assets. On staking with pSTAKE, users earn staking rewards and also receive 1:1 peg stake representative tokens (stkTOKENs) which use in DeFi to generate additional yield (yield on top of staking rewards).

Website | Twitter