Tower Finance

Submit a Bug
13 October 2021
Live since
No
KYC required
$50,000
Maximum bounty

Program Overview

TOWER token is a Fractional-Algorithmic Stablecoin, soft pegged to the U.S. Dollar, available on the Polygon network. Tower is permissionless, and entirely on-chain – currently implemented on the Polygon chain with plans to expand to multi-chain.

For more information about Tower Finance, please visit https://towerfinance.io/

This bug bounty program is focused on their smart contracts and app and is focused on preventing:

  • Thefts and freezing of principal of any amount
  • Thefts and freezing of unclaimed yield of any amount
  • Theft of governance funds
  • Governance activity disruption
  • Website goes down
  • Leak of user data
  • Deletion of user data
  • Access to sensitive pages without authorization

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web/app bug reports must come with a PoC in order to be considered for a reward. No PoC is required for smart contract/blockchain bug reports.

Payouts are handled by the Tower Finance team directly and are denominated in USD. Payouts are done in USDC.

Smart Contracts and Blockchain

Critical
Level
USD $50,000
Payout
high
Level
USD $10,000
Payout
medium
Level
USD $1,000
Payout
low
Level
USD $300
Payout

Web and Apps

Critical
Level
USD $5,000
Payout
high
Level
USD $3,000
Payout
medium
Level
USD $1,000
Payout
low
Level
USD $300
Payout

Assets in Scope

All smart contracts of Tower Finance can be found at https://github.com/towerfinance/tower-solidity. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Impacts in Scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Smart Contracts/Blockchain

  • Loss of user funds staked (principal) by freezing or theft
  • Loss of governance funds
  • Theft of unclaimed yield
  • Freezing of unclaimed yield
  • Temporary freezing of funds for any amount of time
  • Governance activity disruption
  • Unable to call smart contract
  • Smart contract gas drainage
  • Smart contract fails to deliver promised returns
  • Vote manipulation
  • Incorrect polling actions
  • TCR/ECR manipulation
  • TWAP manipulation
  • Vulnerability in Mint/Redeem logic
  • Vulnerability in re-collateralize logic
  • Vulnerability in collateral invest logic

Web/App

  • Redirected funds by address modification
  • Site goes down
  • Accessing sensitive pages without authorization
  • Injection of text
  • Leak/deletion of user data
Smart Contract - CollateralOracle
Type
Smart Contract - CollateralRatioPolicy
Type
Smart Contract - CollateralReserve
Type
Smart Contract - ConsolidatedFund
Type
Smart Contract - Dollar
Type
Smart Contract - DollarOracle
Type
Smart Contract - MasterChef_IVORY_0
Type
Smart Contract - PairOracle_DOLLAR_USDC
Type
Smart Contract - PairOracle_SHARE_USDC
Type
Smart Contract - PoolUSDC
Type
Smart Contract - Share
Type
Smart Contract - ShareOracle
Type
Smart Contract - Timelock
Type
Smart Contract - Treasury
Type
Smart Contract - TreasuryFund
Type
Smart Contract - TreasuryPolicy
Type
Smart Contract - TreasuryVaultAave
Type
Smart Contract - VaultController
Type
Smart Contract - ZapPool
Type
Web/App
Type

Prioritized Vulnerabilities

We are especially interested in receiving and rewarding vulnerabilities of the following types:

Smart Contracts and Blockchain

  • Re-entrancy
  • Logic errors
    • including user authentication errors
  • Solidity/EVM details not considered
    • including integer over-/under-flow
    • including rounding errors
    • including unhandled exceptions
  • Trusting trust/dependency vulnerabilities
    • including composability vulnerabilities
  • Oracle failure/manipulation
  • Novel governance attacks
  • Economic/financial attacks
    • including flash loan attacks
  • Congestion and scalability
    • including running out of gas
    • including block stuffing
    • including susceptibility to frontrunning
  • Consensus failures
  • Cryptography problems
    • Signature malleability
    • Susceptibility to replay attacks
    • Weak randomness
    • Weak encryption
  • Susceptibility to block timestamp manipulation
  • Missing access controls / unprotected internal or debugging interfaces

Websites and Apps

  • Remote Code Execution
  • Trusting trust/dependency vulnerabilities
  • Vertical Privilege Escalation
  • XML External Entities Injection
  • SQL Injection
  • LFI/RFI
  • Horizontal Privilege Escalation
  • Stored XSS
  • Reflective XSS with impact
  • CSRF with impact
  • Direct object reference
  • Internal SSRF
  • Session fixation
  • Insecure Deserialization
  • DOM XSS
  • SSL misconfigurations
  • SSL/TLS issues (weak crypto, improper setup)
  • URL redirect
  • Clickjacking (must be accompanied with PoC)
  • Misleading Unicode text (e.g. using right to left override characters)

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that the reporter has already exploited themselves, leading to damage
  • Attacks requiring access to leaked keys/credentials
  • Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Basic economic governance attacks (e.g. 51% attack)
  • Lack of liquidity
  • Best practice critiques
  • Sybil attacks

Websites and Apps

  • Theoretical vulnerabilities without any proof or demonstration
  • Content spoofing / Text injection issues
  • Self-XSS
  • Captcha bypass using OCR
  • CSRF with no security impact (logout CSRF, change language, etc.)
  • Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
  • Server-side information disclosure such as IPs, server names, and most stack traces
  • Vulnerabilities used to enumerate or confirm the existence of users or tenants
  • Vulnerabilities requiring unlikely user actions
  • URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
  • Lack of SSL/TLS best practices
  • DDoS vulnerabilities
  • Attacks requiring privileged access from within the organization
  • Feature requests
  • Best practices

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
  • Any testing with pricing oracles or third party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty