SushiSwap is an automated market-making (AMM) decentralized exchange (DEX) that allows users to provide liquidity for token swaps.
The bug bounty program is focused around its smart contracts and web app for the purpose of preventing the loss of user funds.
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.
Theft of Yield vulnerability reports are temporarily not in scope for this bug bounty program, though this attack may be in the future.
All web/app bug reports must come with a PoC. All bug reports without a PoC will not be accepted under this bug bounty program.
All critical payments, both for smart contracts and the website, are capped at 10% of economic damage. The only web vulnerabilities in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Sushi interface.
Sushiswap is open to rewarding bounties beyond the critical cap for vulnerabilities with extreme impact.
Payouts are handled by the SushiSwap team directly and are denominated in USD. Payouts worth USD $100,000 and below are done in USDC. Payouts beyond USD $100,000 up to USD 1,000,000 are made in SUSHI, though the first $100,000 can be made in USDC if requested.
- up to USD $1,000,000
- up to USD $40,000
- up to USD $5,000
- up to USD $1,000
- USD $0
Websites and Applications
- up to USD $100,000
Assets in scope
- Smart Contract - BentoBoxType
- Smart Contract - Sushi TokenType
- Smart Contract - MasterChef v1Type
- Smart Contract - Treasury WalletType
- Smart Contract - SushiFactoryType
- Smart Contract - SushiMakerType
- Smart Contract - SushiRouterType
- Smart Contract - Kashi LendingType
- Smart Contract - ChainlinkOracleV2Type
- Smart Contract - SushiSwapSwapperV1Type
- Smart Contract - KashiPairMediumRiskV1Type
- Smart Contract - SushiDistributorType
- TargetWebsites and ApplicationsType
A full list of the smart contracts of SushiSwap can be found in their Github repository. However, only the contracts listed in this table are considered as within the scope of the bug bounty program.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
- Critical Smart Contract ImpactCriticalImpact
- High Smart Contract ImpactHighImpact
- Medium Smart Contract ImpactMediumImpact
- Low Smart Contract ImpactLowImpact
Websites and Applications
- Critical Websites and Applications ImpactCriticalImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited himself, leading to damage
- Attacks that rely on social engineering
- Attacks requiring access to leaked keys/credentials
- Incorrect data supplied by third party oracles/exchange rate being outdated
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Loss of positive slippage through Sandwich Attacks
- Lack of liquidity
- Best practice critiques
- Sybil attacks
Websites and Apps
- Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope
The following activities are prohibited by bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty