17 December 2021
Live since
No
KYC required
$80,000
Maximum bounty
25 October 2022
Last updated

Program Overview

Ambire Wallet is a DeFi-focused smart wallet that aims to provide better UX than Metamask, while still having power user features. Ambire is a smart wallet, which enables paying gas in stablecoins, automatic Flashbots/Eden frontrunning protection, batching (doing multiple things in one tx!), hardware wallets (Trezor/Ledger). It is web based, there’s no extension required, and you can connect to any dApp with WalletConnect.

For more information about Ambire, please visit https://www.ambire.com/.

This bug bounty program is focused on their smart contracts and is focused on preventing:

  • Thefts and freezing of principal of any amount
  • Thefts and freezing of unclaimed yield of any amount
  • Theft of governance funds
  • Governance activity disruption

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All High and Critical Smart Contract bug reports require a PoC and a suggestion for a fix to be eligible for a reward. All Low and Medium Smart contract bug reports require a suggestion for a fix to be eligible for a reward.

The following vulnerabilities are not eligible for a reward:

https://github.com/AmbireTech/code4rena#known-tradeoffs

Payouts are handled by the Ambire team directly and are denominated in USD. However, payouts are done in ETH unless agreed otherwise.

Smart Contract

Critical
Level
USD $80,000
Payout
PoC Required
High
Level
USD $30,000
Payout
PoC Required
Medium
Level
USD $10,000
Payout
Low
Level
USD $3,000
Payout

Assets in scope

All smart contracts of Ambire can be found at https://github.com/AmbireTech/ambire-wallet/tree/development/contracts and https://github.com/AmbireTech/wallet/tree/main/contracts. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contract

  • Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
    Critical
    Impact
  • Permanent freezing of funds
    Critical
    Impact
  • Miner-extractable value (MEV)
    Critical
    Impact
  • Protocol Insolvency
    Critical
    Impact
  • Any governance voting result manipulation
    Critical
    Impact
  • Theft of unclaimed yield
    High
    Impact
  • Temporary freezing of funds
    High
    Impact
  • Smart contract unable to operate due to lack of token funds
    Medium
    Impact
  • Block stuffing for profit
    Medium
    Impact
  • Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
    Medium
    Impact
  • Unbounded gas consumption
    Medium
    Impact
  • Theft of gas
    Medium
    Impact
  • Permanent freezing of unclaimed yield
    Medium
    Impact
  • Contract fails to deliver promised returns, but doesn't lose value
    Low
    Impact
  • Centralization risks
    Low
    Impact

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that are already reported in other reports (see github.com/ambireTech/wallet#audits), regardless of their current status
  • Attacks that the reporter has already exploited themselves, leading to damage
  • Attacks requiring access to leaked keys/credentials
  • Attacks requiring access to privileged addresses (governance, strategist)
  • Characteristics related to the nature of public blockchains, for example being able to publicly enumerate all Ambire smart wallet accounts

Smart Contracts and Blockchain

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Basic economic governance attacks (e.g. 51% attack)
  • Lack of liquidity
  • Best practice critiques
  • Sybil attacks
  • Any issue related to third-party contracts not supporting smart contract signatures (EIP 1271). Those should be reported to the said third-party contracts.
  • Anything documented in https://github.com/AmbireTech/code4rena#known-tradeoffs

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
  • Any testing with pricing oracles or third party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty