In addition to the smart contracts in this table, the following information has been provided for reference. However, only the smart contracts in the table will be considered as in-scope:

dForce advocates for building an integrated and interoperable open finance protocol matrix covering  lending (global liquidity pool, yield markets), assets (stablecoin, synthetic asset, etc), and trading (liquidity aggregator, AMM).

Contract fails to deliver promised returns, but doesn't lose value

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Miner-extractable value (MEV)

Protocol insolvency

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

These accepted impacts are then based on the severity classification system of this bug bounty program. When submitting a bug report, please select the severity level you feel best corresponds to the severity classification system as long as the impact itself is one of the listed items.

dForce Smart Contracts

dForce Documentation

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. 

All bug reports must come with a PoC in order to be considered for a reward, bug reports without a PoC will be rejected.

Critical vulnerabilities for smart contracts are further defined by the following conditions. All need to be met in order to get the classification of critical. 

  - Allow attacker(s) to take away collateral tokens for at least 10% in dollar value of collateral tokens from the system.
  - Are applied to a real situation and triggered through an attack vector rather than theory or hypothesis. 
  - Occur in operation mode or emergency shutdown mode, excluding those occurring during or shortly after the deployment when the system is yet to become fully activated.

Please note this Bug Bounty Program does not cover vulnerabilities pertaining to 1) protocols built by third-party developers (i.e., smart contract wallet); 2) ownership of an admin key.

The reward of critical smart contract vulnerabilities is capped at 10% of economic damage, primarily taking into account the funds at risk. The dForce team may, at their discretion, decide to increase the reward based on PR and branding aspects.

Payouts are handled by the __dForce__ team directly and are denominated in USD. However, payouts are done in __DF__.

The target asset is a link of Github which lists all major contracts of dForce suitable for bounty.

Title	Description	Link
dForce Smart Contracts	Lending & Synthetic Assets
dForce Smart Contracts	Farming

dForce

Codebase

Documentation