Bancor

The Bancor Protocol is anon-chain liquidity protocol that enables automated, decentralized exchange any smart contract-enabled blockchain. The Bancor Protocol is an open-source standard for liquidity pools, which in turn provide an endpoint for automated market-making (buying / selling tokens) against a smart contract.

The Bancor Network currently operates on the Ethereum and is designed to be interoperable across blockchains. Our implementation can be easily integrated into any application enabling value exchanges and is open-source and permissionless. Ecosystem participants are encouraged to contribute to and enhance the Bancor Protocol.

Further resources regarding Bancor can be found on their website,

The bug bounty program is focused around their smart contracts and is mostly concerned with the loss of user funds. This program is further covered by the Armor Alliance Bug Bounty Challenge.

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Theft of yield/interest is only considered as High if at least USD 100 000 can be stolen. If not, the severity is reduced to Medium.

For any bug reports to be eligible for a reward, they must include:

• Conditions on which reproducing the bug is contingent.
• Steps needed to reproduce the bug or, preferably, a proof of concept.
• Implications of the vulnerability being abused.

Additionally, any bug reporter who reports a previously unreported bug that results in a change to the code or a configuration change and who keeps the vulnerability confidential until it has been resolved by our engineers, will be recognized publicly for their contribution, if agreed and desired by the bug reporter.

All reward decisions, including eligibility for and amounts of the rewards and the manner in which such rewards will be paid, are made at Bancor’s sole discretion.

Payouts for Low to High bug reports as well as the first USD 50 000 of Critical bug reports are handled by the Bancor core devs directly and are denominated in USD. However, payouts are done in BNT. For Critical bug reports, the remaining USD 50 000 is paid by ArmorFi under the Armor Alliance Bug Bounty Challenge in ARMOR with a vesting period of up to 24 months.

Eligibility

To be eligible for a reward in the Bancor Bug Bounty Program, you must:

• Make a good faith effort to avoid privacy violations, destruction of data, interruption, or degradation of Bancor.
• Provide sufficient information to enable our engineers to reproduce and fix the vulnerability.
• Not be one of our current or former employees, vendors, or contractors or an employee of any of those vendors or contractors.

We are especially interested in receiving and rewarding vulnerabilities of the following types:

Smart Contracts/Blockchain:

• Re-entrancy
• Logic errors
  • including user authentication errors
• Solidity/EVM details not considered
  • including integer over-/under-flow
  • including unhandled exceptions
• Trusting trust/dependency vulnerabilities
  • including composability vulnerabilities
• Oracle failure/manipulation
• Novel governance attacks
• Economic/financial attacks
  • including flash loan attacks
• Congestion and scalability
  • including running out of gas
  • including block stuffing
  • including susceptibility to frontrunning
• Consensus failures
• Cryptography problems
  • Signature malleability
  • Susceptibility to replay attacks
  • Weak randomness
  • Weak encryption
• Susceptibility to block timestamp manipulation
• Missing access controls / unprotected internal or debugging interfaces

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)
• Incorrect data supplied by third party oracles
  • Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Bugs in any third party contract or platform that interacts with the Bancor protocol
  • Not to exlcude oracle manipulation/flash loan attacks

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty