Badger

Program Overview

Badger DAO builds applications to help bring Bitcoin to DeFi.

Verification

Verification of Badger DAO’s bug bounty program on Immunefi is available at https://badger-finance.gitbook.io/badger-finance/bug-bounty

Rewards by Threat Level

Rewards are distributed according to the exploitability level of the vulnerability and its impact based on the Immunefi Vulnerability Severity Classification System.

All bounties are capped at a maximum of 10% of the funds potentially affected.

Level
Critical - Empty or freeze the contract’s holdings	Up to $500,000
High - Token holders temporarily unable to transfer holdings	Up to $5,000
Medium - Denial of Service (e.g. unbounded gas, block stuffing)	Up to $500
Low - Contract fails to deliver promised returns (e.g. high-level economic errors)	Up to $250
None - N/A	$0

Payouts are handled by Badger directly. Payouts are denominated in USD and are paid out in the reporter’s choice of:

• Badger,
• Ethereum
• Bitcoin
• a stablecoin
  • USDC
  • DAI
  • USDT

Assets in Scope

• https://github.com/Badger-Finance/badger-system

Prioritized Vulnerabilities

We are especially interested in receiving and rewarding vulnerabilities of the following types:

• Re-entrancy
• Logic errors
  • including user authentication errors
• Solidity/EVM details not considered
  • including integer over-/under-flow
  • including unhandled exceptions
• Trusting trust/dependency vulnerabilities
  • including composability vulnerabilities
• Oracle failure/manipulation
• Economic/financial attacks
  • including flash loan attacks
• Congestion and scalability
  • including running out of gas

Out of Scope

The following vulnerabilities are not eligible for bounties under this program:

• Theoretical vulnerabilities without any proof or demonstration
• Incorrect data supplied by third party oracles
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques

Additionally, Badger’s website hosted at https://badger.finance/ and the infrastructure that hosts that site are excluded from this bug bounty program. Reports of web vulnerabilities that do not impact Badger’s Web3 smart contract interface will not receive a payout under this program. Web vulnerabilities that are claimed to impact Badger’s Web3 smart contract interface must be accompanied by a proof-of-concept exploit. Web vulnerabilities may be included in future versions of this program; watch this page for updates.

Rules

The following actions and behaviors are prohibited. Doing so will prevent collection of a bounty and may result in prosecution:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against employees and/or customers
• Testing any denial of service attacks
• Automated testing of services that generates significant amounts of spam transactions
• Disassembly or reverse engineering of binaries for which source code is not published, not including smart contract bytecode
• Public disclosure of an unpatched vulnerability