SushiSwap

SushiSwap is an automated market-making (AMM) decentralized exchange (DEX) that allows users to provide liquidity for token swaps.

The bug bounty program is focused around its smart contracts and web app for the purpose of preventing the loss of user funds.

This bug bounty program is further covered by the Armor Alliance Bug Bounty Challenge.

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Theft of Yield vulnerability reports are temporarily not in scope for this bug bounty program, though this attack may be in the future.

All web/app bug reports must come with a PoC. All bug reports without a PoC will not be accepted under this bug bounty program.

All critical payments, both for smart contracts and the website, are capped at 10% of economic damage. The only web vulnerabilities in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Sushi interface.

Sushiswap is open to rewarding bounties beyond the critical cap for vulnerabilities with extreme impact.

Payouts are handled by the SushiSwap team directly and are denominated in USD. Payouts worth USD $100,000 and below are done in USDC. Payouts beyond USD $100,000 up to USD 1,000,000 are made in SUSHI, though the first $100,000 can be made in USDC if requested. Payouts above USD 1,000,000 have the remainder paid in ARMOR under the Armor Alliance Bug Bounty Challenge with a vesting period of up to 24 months.

A full list of the smart contracts of SushiSwap can be found in their Github repository. However, only the contracts listed in this table are considered as within the scope of the bug bounty program.

We are especially interested in receiving and rewarding vulnerabilities of the following types:

Smart Contracts/Blockchain:

• Re-entrancy
• Logic errors
  • including user authentication errors
• Solidity/EVM details not considered
  • including integer over-/under-flow
  • including unhandled exceptions
• Trusting trust/dependency vulnerabilities
  • including composability vulnerabilities
• Oracle failure/manipulation
  • excluding real market activity
  • excluding external oracle manipulation
• Novel governance attacks
• Congestion and scalability
  • including running out of gas
  • including block stuffing
  • including susceptibility to frontrunning
• Consensus failures
• Cryptography problems
  • Signature malleability
  • Susceptibility to replay attacks
  • Weak randomness
  • Weak encryption
• Susceptibility to block timestamp manipulation
• Missing access controls / unprotected internal or debugging interfaces

Web/App

• For web vulnerabilities, Sushiswap is strictly interested in those that cause direct and unequivocal loss or permanent locking of user funds
• An example would be a vulnerability that lets an attacker spoof transactions on Sushi web applications, leading to theft of funds

The following vulnerabilities are excluded from the rewards for this bug bounty program:

All programs

• Attacks that the reporter has already exploited himself, leading to damage
• Attacks that rely on social engineering
• Attacks requiring access to leaked keys/credentials

Smart Contracts/Blockchain

• Incorrect data supplied by third party oracles/exchange rate being outdated
  • Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Loss of positive slippage through Sandwich Attacks
• Lack of liquidity
• Best practice critiques
• Sybil attacks

Websites and Apps

• Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty