Autonolas
Submit a BugProgram Overview
Autonolas enables DAOs to create, run and own autonomous services that power next-gen apps in DAO operations, treasury management, AI, and beyond. Autonolas protocol provides means to build, register, co-own, manage and secure autonomous services: off-chain services which run as a multi-agent-system (MAS) and are replicated on a temporary consensus gadget (blockchain) while being crypto-economically secured on a public blockchain, hence offering robustness, transparency and decentralization off-chain.
For more information about Autonolas, please visit https://olas.network.
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.
Critical and high smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of USD 6 000 for high smart contract vulnerabilities and 12 000 for critical ones.
All Critical, High, and Medium Smart Contract bug reports must come with a PoC, have an end-effect impact, and an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.
The following vulnerabilities are not eligible for a reward:
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/audits
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/docs
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/test
- All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-governance/tree/main/contracts
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/audits
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/docs
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/test
- All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-registries/tree/main/contracts
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/audits
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/docs
- All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/test
- All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-tokenomics/tree/main/contracts
- All vulnerabilities found in the inherited source code from OpenZeppelin (https://github.com/OpenZeppelin/openzeppelin-contracts) and Solmate (https://github.com/transmissions11/solmate)
- All vulnerabilities found in the inherited source code for the bridging contracts from Polygon and Gnosis Chain Docs.
- All vulnerabilities found in code based on or inspired by Maple Finance (https://github.com/maple-labs) Curve DAO https://github.com/curvefi/curve-dao-contracts Uniswap Labs (https://github.com/Uniswap/v2-core), PaulRBerg (https://github.com/paulrberg/prb-math), Jeiwan (https://github.com/Jeiwan/zuniswapv2), Safe Ecosystem (https://github.com/safe-global/safe-contracts) and that are already reported to one of those projects.
- All vulnerabilities that arise from misconfigured registration from users (e.g. component owners, agent owners, service owners, agents operators) or misuse of the registration logic (e.g. accidental locking of funds, loss of keys to control services, etc.).
Autonolas requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an invoice with Name, Address, and Country of the hacker or a legal entity used for transactions. If the hacker is based in Switzerland they need to account for VAT in the invoice. The collection of this information will be done by the Autonolas team.
Payouts are handled by the Autonolas team directly and are denominated in USD. However, payouts are done in USDT and USDC, with the choice of the ratio at the discretion of the team.
Smart Contract
- Critical
- Level
- Up to USD $50,000
- Payout
- High
- Level
- Up to USD $20,000
- Payout
- Medium
- Level
- USD $5,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Assets in scope
- Smart Contract - Autonolas (OLAS)Type
- Smart Contract - TimelockType
- Smart Contract - Voting Escrow OLAS (veOLAS)Type
- Smart Contract - Governor OLASType
- Smart Contract - Burnable Locked Olas (buOLAS)Type
- Smart Contract - Wrapped Voting Escrow OLAS (wveOLAS)Type
- Smart Contract - FxGovernorTunnelType
- Smart Contract - HomeMediatorType
- Smart Contract - Component RegistryType
- Smart Contract - Agent RegistryType
- Smart Contract - Service RegistryType
- Smart Contract - Service Registry Token UtilityType
- Smart Contract - Registries ManagerType
- Smart Contract - Service Manager TokenType
- Smart Contract - Operator WhitelistType
- Smart Contract - Gnosis Safe MultisigType
- Smart Contract - Gnosis Safe Multisig Same AddressType
- Smart Contract - Service Registry L2Type
- Smart Contract - Service ManagerType
- Smart Contract - TreasuryType
- Smart Contract - Tokenomics ProxyType
- Smart Contract - TokenomicsType
- Smart Contract - Generic Bond CalculatorType
- Smart Contract - DepositoryType
- Smart Contract - DispenserType
- Smart Contract - Donator BlacklistType
All smart contracts of Autonolas can be found at
- https://github.com/valory-xyz/autonolas-governance/tree/v1.1.4
- https://github.com/valory-xyz/autonolas-registries/tree/v1.1.3
- https://github.com/valory-xyz/autonolas-tokenomics/tree/v1.0.2
However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Smart Contract
- Any governance voting result manipulationCriticalImpact
- Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yieldCriticalImpact
- Permanent freezing of fundsCriticalImpact
- Protocol insolvencyCriticalImpact
- Theft of unclaimed yieldHighImpact
- Permanent freezing of unclaimed yieldHighImpact
- Temporary freezing of funds for more that 7 daysHighImpact
- Smart contract unable to operate due to lack of token fundsMediumImpact
- Block stuffing for profitMediumImpact
- Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)MediumImpact
- Theft of gasMediumImpact
- Unbounded gas consumption (Only governance related contracts are in scope for this kind of vulnerability, i.e. OLAS, Timelock, veOLAS, wveOLAS, Governor OLAS, buOLAS, FxGovernorTunnel, HomeMediator)MediumImpact
- Smart contract fails to deliver promised returns, but doesn’t lose valueLowImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist, community multisig)
- Attacks building on already identified attacks
Smart Contracts and Blockchain
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
- Centralization risks
- Attacks that attempt to disrupt the protocol's availability, such as flooding the system with an excessive number of non-useful components or non-useful components within agents, resulting in gas resource exhaustion. Additionally, attacks that attempt to cause gas resource exhaustion issues by making minimal donations to a large number of services with numerous components.
- All vulnerabilities that arise from misconfigured registration from users (e.g. component owners, agent owners, service owners, agents operators) or misuse of the registration logic (e.g. accidental locking of funds, loss of keys to control services, etc.).
- The following are considered out of scope for “permanent freezing of funds” Critical Impact: when the freezing of funds is attributed to unintended use of the contracts: Component Registry, Agent Registry, Service Registry, Service Registry Token Utility, Registries Manager, Service Manager Token, Operator Whitelist, Gnosis Safe Multisig, Gnosis Safe Multisig Same Address, Service Registry L2, Service Manager.
- The following contract are not in scope for “Griefing” Medium Impact: Component Registry, Agent Registry, Service Registry, Service Registry Token Utility, Registries Manager, Service Manager Token, Operator Whitelist, Gnosis Safe Multisig, Gnosis Safe Multisig Same Address, Service Registry L2, Service Manager
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty