Audit Comp | Folks: Liquid Staking

Asset Accuracy Assurance

Bugs found on assets incorrectly listed in-scope will be considered valid and be rewarded.

Build commands, Test commands, and instructions on how to run them:

You can find the smart contract repository at https://github.com/Folks-Finance/algo-liquid-staking-contracts. Follow the instructions in the README to get setup and be able to run the tests

Impact Terms

Public Disclosure of Known Issues

Bug reports covering previously-discovered bugs (listed below) are not eligible for a reward within this program. This includes known issues that the project is aware of but has consciously decided not to “fix”, necessary code changes, or any implemented operational mitigating procedures that can lessen potential risk.

• You cannot delete an added proposer.
• A proposer’s balance may go below the minimum balance needed in order to be eligible for consensus rewards.
• A decrease in the max proposer balance may lead to some proposer balances being temporarily above the limit.
• Unclaimed fees are generating additional yield for everyone.
• Unclaimed fees can be slightly reduced through often updates because of rounding down.
• Loss of precision over time as the value of xALGO accumulates.
• The smart contract doesn’t check for box cost payments - instead they are implicitly required.

Previous Audits

Folks Finance’s completed audit reports can be found at https://github.com/Folks-Finance/audits/blob/50831a54420ed3e4513c8fa17a42f2bbd0338df1/Coinspect%20-%20Audit%20of%20Liquid%20Staking%20-%20August%202024.pdf. Note that this is an audit on the previous version of the smart contract which shares similarities with the new version. Any unfixed vulnerabilities mentioned in these reports are not eligible for a reward.

Eligibility Criteria

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:

• On OFACs SDN list
• Official contributor, both past or present
• Employees and/or individuals closely associated with the project
• Security auditors that directly or indirectly participated in the audit review

Private Known Issues Reward Policy

Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward equal to that of a bug one severity lower.

Primacy of Impact vs Primacy of Rules

Folks Finance adheres to the Primacy of Rules, which means that the whole bug bounty program is run strictly under the terms and conditions stated within this page.

Responsible Publication

Whitehats may publish their bug reports after they have been fixed & paid, or closed as invalid, with the following exceptions:

• Bug reports in mediation may not be published until mediation has concluded and the bug report is resolved.

Immunefi may publish bug reports submitted to this audit competition and a leaderboard of the participants and their earnings.

Immunefi Standard Badge

By adhering to Immunefi’s best practice recommendations, Folks Finance has satisfied the requirements for the Immunefi Standard Badge.