SushiSwap

SushiSwap is an automated market-making (AMM) decentralized exchange (DEX) that allows users to provide liquidity for token swaps.

The bug bounty program is focused around its smart contracts and web app for the purpose of preventing the loss of user funds.

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Theft of Yield vulnerability reports are temporarily not in scope for this bug bounty program, though this attack may be in the future.

All web/app bug reports must come with a PoC. All bug reports without a PoC will not be accepted under this bug bounty program.

All critical payments, both for smart contracts and the website, are capped at 10% of economic damage. The only web vulnerabilities in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Sushi interface.

Sushiswap is open to rewarding bounties beyond the critical cap for vulnerabilities with extreme impact.

Payouts are handled by the SushiSwap team directly and are denominated in USD. Payouts worth USD $100,000 and below are done in USDC. Payouts beyond USD $100,000 up to USD 1,000,000 are made in SUSHI, though the first $100,000 can be made in USDC if requested.

Smart Contract

Websites and Applications

A full list of the smart contracts of SushiSwap can be found in their Github repository. However, only the contracts listed in this table are considered as within the scope of the bug bounty program.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

All programs

• Attacks that the reporter has already exploited himself, leading to damage
• Attacks that rely on social engineering
• Attacks requiring access to leaked keys/credentials

Smart Contracts/Blockchain

• Incorrect data supplied by third party oracles/exchange rate being outdated
  • Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Loss of positive slippage through Sandwich Attacks
• Lack of liquidity
• Best practice critiques
• Sybil attacks

Websites and Apps

• Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty