KAST is a stablecoin-powered financial platform that gives you global access to your money — to hold, send, and spend instantly, anywhere. Built for people who live, work, and earn beyond one country, KAST delivers real financial freedom without the need for a traditional bank.
Triaged by Immunefi
PoC Required
KYC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Public Disclosure of Known Issues
Bug reports covering previously-discovered bugs (listed below) are not eligible for a reward within this program. This includes known issues that the project is aware of but has consciously decided not to “fix”, perform necessary code changes, or any implemented operational mitigating procedures that can lessen potential risk.
- Unsupported Mint Extensions - Acknowledged
- In m_ext , the code utilizes trunc and floor to convert multiplier * INDEX_SCALE_F64 into an integer index, which may result in discarding edge cases with small fractional parts such as .9995 , creating an off-by-one error
- Retroactive Fee Application for Crank Version of Extensions - Acknowledged
- Earners Will Lose Pending Yield When Removed - Acknowledged
- ext_mint Can Have CloseMintAuthority & PermanentDelegate Extensions Activated - Acknowledged
Any unfixed vulnerabilities mentioned in these reports are not eligible for a reward.
Incorrect calculation of multisig signers required for transaction processing
Permanent freezing of funds
Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Protocol insolvency
Permanent freezing of unclaimed yield
Permanent freezing of unclaimed royalties
Temporary freezing of funds
Theft of unclaimed yield
Theft of unclaimed royalties
Prevention of governance participation despite design parameters providing participation rights
Smart contract unable to operate due to lack of token funds
Out of scope
All Categories:
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (governance, strategist) except in such cases where the contracts are intended to have no privileged access to functions that make the attack possible
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers
- Impacts relying on theoretical user interactions without any demonstration of regular or significant occurrence
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks