06 January 2022
Live since
No
KYC required
$3,333,333
Maximum bounty

Program Overview

Olympus is a decentralized reserve currency protocol based on the OHM token. Each OHM token is backed by a basket of assets (e.g. DAI, FRAX) in the Olympus treasury, giving it an intrinsic value. Olympus also introduces unique economic and game-theoretic dynamics into the market through staking and bonding.

For more information about Olympus, please visit https://www.olympusdao.finance/.

This bug bounty program is focused on their smart contracts and app and is focused on preventing:

  • Loss of treasury funds
  • Loss of user funds
  • Loss of bond funds

This bug bounty program is being run by the Olympus DAO under OIP-38, an extension of OIP-17 and OIP-34.

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All bug reports must come with a PoC in order to be considered for a reward. Smart contract bug reports must have the PoC be fully runnable.

Critical vulnerabilities are further subcategorized into two tiers:

  • Tier 1: For bugs/exploits which would lead to a loss of bond funds or a loss of user funds, a flat reward of USD 333 333 is provided.
  • Tier 2: For bugs/exploits which would lead to a loss of treasury funds, a flat reward of USD 3 333 333 is provided.

For vulnerabilities of websites and applications, only bugs that lead to direct financial damage listed in the Impacts in Scope are accepted and are categorized as critical. All others are not accepted. An example of an acceptable vulnerability in this category would be https://rekt.news/badger-rekt/.

Payouts are handled by the Olympus DAO directly and are denominated in USD, under the terms set out in OIP-38. However, payouts are done in USDC.

Smart Contracts and Blockchain

Critical
Level
Up to USD $3,333,333
Payout

Web and Apps

Critical
Level
Up to USD $3,333,333
Payout

Assets in Scope

All smart contracts of Olympus can be found at https://github.com/OlympusDAO/olympus-contracts. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Impacts in Scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contracts/Blockchain

  • Loss of treasury funds
  • Loss of user funds
  • Loss of bond funds

Web/App

  • Loss of treasury funds
  • Loss of user funds
  • Loss of bond funds

Prioritized Vulnerabilities

We are especially interested in receiving and rewarding vulnerabilities of the following types:

Smart Contracts and Blockchain

  • Any vulnerability that directly has an impact in scope.

Websites and Applications

  • Any vulnerability that directly has an impact in scope.

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that the reporter has already exploited themselves, leading to damage
  • Attacks requiring access to leaked keys/credentials
  • Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

  • Anything that doesn’t directly lead to an impact in scope.
  • Centralization risks

Websites and Applications

  • Anything that doesn’t directly lead to an impact in scope.

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
  • Any testing with pricing oracles or third party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty