NASDEX is a decentralized exchange that offers users the ability to trade tokenized equities on blockchain via their minting and trading mechanism that mimics the offchain economics of the real world equity price. A user-friendly platform where investors could buy and sell tokenized equity as easily as crypto with 24/7 trading, fractionalized share buying, and yield farming.
For more information about NASDEX, please visit https://www.nasdex.xyz/.
This bug bounty program is focused on their smart contracts and is focused on preventing:
- Thefts and freezing of principal of any amount
- Thefts and freezing of unclaimed yield of any amount
- Theft of governance funds
- Oracle price attack
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2. This is a simplified 5-level scale, with separate scales for smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.
All smart contract bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required. Critical bug reports must also come with a suggestion for a fix in order to be considered for a reward.
Payouts are handled by the NASDEX team directly and are denominated in USD. However, payouts are done in USDT.
- USD $15,000
- USD $5,000
Assets in scope
- Smart Contract - MintType
- Smart Contract - SwapRouterType
- Smart Contract - SwapFactoryType
- Smart Contract - MasterChefType
- Smart Contract - AdminType
- Smart Contract - SwappableLibType
- Smart Contract - PositionsType
- Smart Contract - ShortLockType
- Smart Contract - ShortStakingType
- Smart Contract - LongStakingType
- Smart Contract - MultiCallType
All smart contracts of NASDEX can be found at https://github.com/NasDex/. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
- Thefts and permanent freezing of principal of any amountCriticalImpact
- Theft of governance fundsCriticalImpact
- Oracle price attacksCriticalImpact
- Thefts and permanent freezing of unclaimed yield of any amountHighImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist)
Smart Contracts and Blockchain
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice critiques
- Sybil attacks
- Centralization risks
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty