Multichain
Submit a BugProgram Overview
Multichain is the ultimate Router for web3. It is an infrastructure developed for arbitrary cross-chain interactions.
For more information about Multichain, please visit https://multichain.org/.
This bug bounty program is focused on their smart contracts, website and app and is focused on preventing:
- Any governance voting result manipulation
- Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
- Permanent freezing of funds
- Miner-extractable value (MEV)
- Insolvency
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2. This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.
All web/app bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. All Critical Smart Contract bug reports require a PoC and a suggestion for a fix to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.
Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of USD 100 000.
All vulnerabilities marked in the security reviews are not eligible for a reward.
Payouts are handled by the Multichain team directly and are denominated in USD. However, payouts are done in USDC.
Smart Contract
- Critical
- Level
- Up to USD $2,000,000
- Payout
- High
- Level
- USD $100,000
- Payout
- Medium
- Level
- USD $10,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Websites and Applications
- Critical
- Level
- USD $200,000
- Payout
- High
- Level
- USD $50,000
- Payout
- Medium
- Level
- USD $5,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Assets in scope
- Smart Contract - AnyswapV6RouterType
- Smart Contract - AnyswapV6ERC20Type
- Smart Contract - AnyCallProxyType
- Smart Contract - MultiDaoType
- Smart Contract - SwapTokensType
- Smart Contract - MultichainTokenType
- TargetWebsites and Applications - Main Web App MultichainType
- TargetWebsites and Applications - AnyswapType
- Websites and Applications - Main AppType
All smart contracts of Multichain can be found at https://github.com/anyswap. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Smart Contract
- Any governance voting result manipulationCriticalImpact
- Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yieldCriticalImpact
- Permanent freezing of fundsCriticalImpact
- InsolvencyCriticalImpact
- Miner-extractable value (MEV)CriticalImpact
- Theft of unclaimed yieldHighImpact
- Permanent freezing of unclaimed yieldHighImpact
- Temporary freezing of funds for a minimum period of 2 daysHighImpact
- Smart contract unable to operate due to lack of fundsMediumImpact
- Block stuffing for profitMediumImpact
- Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)MediumImpact
- Unbounded gas consumptionMediumImpact
- Theft of gasMediumImpact
- Smart contract fails to deliver promised returns, but doesn’t lose valueLowImpact
Websites and Applications
- Ability to execute system commandsCriticalImpact
- Extract Sensitive data/files from the server such as /etc/passwdCriticalImpact
- Stealing User CookiesCriticalImpact
- Taking Down the application/websiteCriticalImpact
- Bypassing AuthenticationCriticalImpact
- Signing transactions for other usersCriticalImpact
- Redirection of user deposits and withdrawalsCriticalImpact
- Subdomain takeover resulting in financial loss (applicable for subdomains with addresses published)CriticalImpact
- Wallet interaction modification resulting in financial lossCriticalImpact
- Direct theft of user fundsCriticalImpact
- Tampering with transactions submitted to the user’s walletCriticalImpact
- Submitting malicious transactions to an already-connected walletCriticalImpact
- Spoofing content on the target application (Persistent)HighImpact
- Users Confidential information disclosure such as EmailHighImpact
- Subdomain Takeover without financial loss (applicable for subdomains with no addresses published)HighImpact
- Privilege escalation to access unauthorized functionalitiesHighImpact
- Changing details of other users without direct financial impact (CSRF)MediumImpact
- Third-Party API keys leakage that demonstrates loss of funds or modification on the websiteMediumImpact
- Redirecting users to malicious websites (Open Redirect)MediumImpact
- Framing sensitive pages leading to financial loss (ClickJacking)LowImpact
- Any impact involving a publicly released CVE without a working PoCLowImpact
- Broken Link HijackingLowImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist)
Smart Contracts and Blockchain
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
- Centralization risks
Websites and Apps
- Theoretical vulnerabilities without any proof or demonstration
- Content spoofing / Text injection issues
- Self-XSS
- Captcha bypass using OCR
- CSRF with no security impact (logout CSRF, change language, etc.)
- Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
- Server-side information disclosure such as IPs, server names, and most stack traces
- Vulnerabilities used to enumerate or confirm the existence of users or tenants
- Vulnerabilities requiring unlikely user actions
- URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
- Lack of SSL/TLS best practices
- DDoS vulnerabilities
- Attacks requiring privileged access from within the organization
- Feature requests
- Best practices
- Vulnerabilities primarily caused by browser/plugin defects
- Any vulnerability exploit requiring CSP bypass resulting from a browser bug
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty