__Asset Accuracy Assurance__

- Bugs found on assets incorrectly listed in-scope will be considered valid and be rewarded.

__Private Known Issues Reward Policy__

- Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

__Primacy of Impact vs Primacy of Rules__

- Flare adheres to the Primacy of Rules, which means that the whole Audit Competition & Mitigation Audit program is run strictly under the terms and conditions stated within this page.

__KYC Requirement__

- No KYC is required for the Flare FAssets Audit Competition & Mitigation Audit

__Eligibility Criteria__

- Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
   - On OFACs SDN list 
   - Official contributor, both past or present
   - Employees and/or individuals closely associated with the project 
   - Security auditors that directly or indirectly participated in the audit review

__Responsible Publication__

- Whitehats may publish their bug reports after they have been fixed & paid, or closed as invalid, with the following exceptions:
   - Bug reports in mediation may not be published until mediation has concluded and the bug report is resolved.

- Immunefi may publish bug reports submitted to this Audit Competition and a leaderboard of the participants and their earnings.

__Feasibility Limitations__

- When there is uncertainty about how feasible an attack is Immunefi will use our feasibility limitation standards to determine the severity of the report.

__Immunefi Standard Badge__

- By adhering to Immunefi’s best practice recommendations, Flare Network has satisfied the requirements for the [Immunefi Standard Badge](https://immunefisupport.zendesk.com/hc/en-us/articles/15006865432209-The-Immunefi-Standard-Badge).

Flare is the blockchain for data. It is a layer-1, EVM smart contract platform designed to expand the utility of blockchain by delivering data certainty for dApp builders. 

FAssets is a trustless, over-collateralized bridge built on Flare that connects non smart contract networks to Flare/Songbird. It enables the creation of wrapped tokens (FAssets) for assets like BTC, DOGE and XRP. 


At the core of FAssets v1.1 is a new architecture component called the Core Vault, designed to improve system liquidity, scalability, and capital efficiency.

Contract fails to deliver promised returns, but doesn't lose value

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Unbounded gas consumption

Temporary freezing of funds for at least 24 hour

Temporary freezing of funds for at least 1 hour

**Build commands, Test commands, and instructions on how to run them:**

- Instructions on how to start the project: https://github.com/flare-foundation/fassets?tab=readme-ov-file#getting-started. The easiest way is to add code in unit tests because the functionality on which the project relates is mocked.
- Look at https://github.com/flare-foundation/fassets/blob/main/test/integration/fasset-simulation/AttackScenarios.ts where researchers have submitted their reports.
- Information and some guides can also be found on Flare Dev Hub: https://dev.flare.network/fassets/overview


**What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported? Which are not?**

- Only ERC20 for FAsset implementation


**Which chains and/or networks will the code in scope be deployed to?**

- Coston (testnet), Coston2 (testnet), Songbird, Flare


**Is this an upgrade of an existing system? If so, which? And what are the main differences?**

- The project is an upgrade of FAssets V1. The new functionality is centered around the core vault, exposed in the `CoreVaultFacet.sol`



**Where do you suspect there may be bugs?**

- Those interacting with new Core Vault features.


**What external dependencies are there?**

- FDC (Flare Data Connector), FTSO-V2 (Flare Time Series Oracle)


**Where might Security Researchers confuse out-of-scope code to be in-scope?**

- The FAssets system is able to support wrapped tokens for XRP, BTC and DOGE. However, the initial v1.1 deployment will only have XRP (FXRP) enabled and that will be the sole scope of this audit competition. Any attacks related to FBTC, FDOGE, or UTXO-based logic in general, are out of scope.
- handshake-based functionalities based on a non-zero `handshakeType` setting are also out of scope.
- Impacts caused by attacks requiring access to an **Agent** role without additional modifications to the privileges attributed are open to be downgraded by one level of severity (e.g. from Critical to High) 


**What addresses would you consider any bug report requiring their involvement to be out of scope, as long as they operate within the privileges attributed to them?**

- governance, core vault multisig

**What addresses would you consider any bug report requiring their involvement be out of scope, even if they exceed the privileges attributed to them?**

- governance (hard to exceed the privileges, as they can update the contracts)


**Previous Audits**

- Flare Network’s completed audit reports can be found at https://dev.flare.network/support/audits/. Unfixed vulnerabilities  mentioned in these reports are not eligible for a reward.

Triggering instructions might run out of gas: the size of the allowed destination addresses will be low (5-10).

Array of escrows always grows: the number of escrows created will be low (if it is more than one or two, we will increase the daily escrow amount). So the total number of escrows will not be huge, perhaps a few hundred.

Escrows finalized close to expiry time decouple the Core Vault internal accountancy: before escrows are released, the triggering bots will be shut down, and they will only be enabled after setEscrowsFinished is called. So there will be no instructions triggered between escrow finalization and the corresponding update on the core vault manager.

Users are unprotected against missing or malformed vault redemption payments: in that case, we assume the core vault has full trust, and its redemptions don't have a time limit. Also, core-vault redeemers are special entities.

Flare Developer Hub

Refer to the inline code documentation directly in the repository.

Technical Details

As an example, you can explore the Redemption function implementation in RedemptionRequestsFacet.sol

Example of Technical Details

Join us as Kristaps and Nejc from the Flare Network's team takes us through a technical walkthrough of their FAssets codebase.

Technical Walkthrough

__Mainnet Audit Competition Reward Pool__

- Rewards are distributed among SRs according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

- Rewards are denominated in USD and distributed in USDC on Ethereum

- The reward pool is **$125,000 USD** if any bug is found.

- If not a single bug is found (Insights do not count as bugs) the reward pool is **$15,000 USD**.

__Mitigation Audit Rewards__

- The maximum reward pool for the mitigation competition is **$25,000 USD**.

- If any bug in scope is fixed during the mainnet AC then a mitigation audit will begin immediately, run simultaneously, and end 5 days after the mainnet Audit Competition has ended.

- The mitigation audit’s reward pool is based on how many bugs are fixed while the competitions are live relative to how many bugs are found in the mainnet Audit Competition. So if projects make more bug fixes mid-competition then the size of the mitigation audit reward pool increases up to the maximum.

- The full mitigation audit reward terms can be [read here](https://immunefisupport.zendesk.com/hc/en-us/articles/33256328266769-Mainnet-Audit-Competition-Rules).

Audit Comp | Flare | FAssets

Status

Status

Leaderboard is Empty