Flamingo Finance
Submit a BugProgram Overview
Flamingo is an interoperable, full-stack decentralized finance protocol built on the Neo blockchain. Flamingo is comprised of five main components, including Wrapper - a crosschain asset gateway, Swap - an on-chain liquidity provider, Vault - a one-stop asset manager, Perp - an AMM-based perpetual contract trading platform, and also DAO - a decentralized governance mechanism. FLM is the governance token of Flamingo and will be 100% distributed to the community based on participation.
For more information about Flamingo Finance, please visit https://flamingo.finance/.
This bug bounty program is focused on their smart contracts, website and app and is focused on preventing:
- Thefts and freezing of unclaimed yield of any amount (including frontend code injection attacks)
- Thefts and freezing of principal of any amount (including frontend code injection attacks)
- Website goes down
- Access to admin accounts without authorization (Cloudflare accounts, service management cloud software, e-mails, etc.)
- Smart contract hacks that lead to users losing funds
- Smart contract hacks that leads to smart contracts malfunctioning
- Smart contract exploits in general
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.
All web/app bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. All High and Critical Smart Contract bug reports require a PoC to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.
Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of USD 50 000.
Payouts are handled by the Flamingo Finance team directly and are denominated in USD. However, payouts are done in GAS.
Smart Contract
- Critical
- Level
- Up to USD $1,000,000
- Payout
- High
- Level
- USD $40,000
- Payout
- Medium
- Level
- USD $4,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Websites and Applications
- Critical
- Level
- USD $25,000
- Payout
- High
- Level
- USD $10,000
- Payout
- Medium
- Level
- USD $1,000
- Payout
Assets in scope
- Smart Contract - Offical NEP17 standardType
- Smart Contract - FLMType
- Smart Contract - SwapType
- Smart Contract - Swap PairsType
- Smart Contract - Staking VaultType
- Websites and ApplicationsType
Assets in Scope Listed Below.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Smart Contract
- Loss of user funds staked (principal) by freezing or theftCriticalImpact
- Theft of unclaimed yieldHighImpact
- Freezing of unclaimed yieldHighImpact
- Temporary freezing of funds for more than one dayHighImpact
Websites and Applications
- Thefts and freezing of unclaimed yield of any amountCriticalImpact
- Thefts and freezing of principal of any amountCriticalImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist)
Smart Contracts and Blockchain
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
- Centralization risks
Websites and Apps
- Theoretical vulnerabilities without any proof or demonstration
- Content spoofing / Text injection issues
- Self-XSS
- Captcha bypass using OCR
- CSRF with no security impact (logout CSRF, change language, etc.)
- Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
- Server-side information disclosure such as IPs, server names, and most stack traces
- Vulnerabilities used to enumerate or confirm the existence of users or tenants
- Vulnerabilities requiring unlikely user actions
- URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
- Lack of SSL/TLS best practices
- DDoS vulnerabilities
- Attacks requiring privileged access from within the organization
- Feature requests
- Best practices
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty