Immunefi
Immunefi

StellaSwap

Submit a Bug
07 July 2022
Live since
No
KYC required
$250,000
Maximum bounty
03 February 2023
Last updated

Program Overview

StellaSwap is the leading DEX on Moonbeam that offers an integrated gateway to the DeFi world. A hybrid DEX by design with both a standard and stable AMM, StellaSwap aims to provide the most secure and optimal trading experience for all users. With a strong focus on simplifying the user experience, StellaSwap’s design principles is predicated on abstracting DeFcomplexities

Beyond being a central liquidity hub, users can swap, earn, yield farm, bridge assets, explore new projects and engage in NFT trading all from a single unified platform.

For more information about StellaSwap, please visit https://stellaswap.com/.

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All bug reports must come with a suggestion for a fix in order to be considered for a reward.

All issues previously highlighted in the following audit reports are also considered out of scope:

Payouts are handled by the StellaSwap team directly and are denominated in USD. However, payouts are done in STELLA. Rewards for High severity bug reports are vested monthly over a 6-month period. Rewards for Critical severity bug reports are vested monthly over a 12-month period.

Smart Contract

Critical
Level
USD $250,000
Payout
PoC Required
High
Level
USD $70,000
Payout
PoC Required

Assets in scope

All smart contracts of StellaSwap can be found at https://github.com/stellaswap/core. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contract

  • Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
    Critical
    Impact
  • Permanent freezing of funds
    Critical
    Impact
  • Temporary freezing of funds for at least 3 days
    High
    Impact

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that the reporter has already exploited themselves, leading to damage
  • Attacks requiring access to leaked keys/credentials
  • Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Basic economic governance attacks (e.g. 51% attack)
  • Lack of liquidity
  • Best practice critiques
  • Sybil attacks
  • Centralization risks

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
  • Any testing with pricing oracles or third party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty