Hydration
Hydration is the leading liquidity protocol on Polkadot. Its mission is to make DeFi efficient, simple, and unstoppable. To achieve this, Hydration unites swaps, lending and a stablecoin currency under the roof of a single, scalable appchain.
PoC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Governance compromise
Identity theft that compromises user’s assets (fungible, non-fungibles)
Unauthorized token minting
Unauthorized NFT minting
Omnipool account theft
Omnipool manipulation resulting in loss/theft of liquidity
Double spending
Direct loss of funds
Transaction/consensus manipulation
Direct theft of user’s assets (fungibles, non-fungibles)
Performing state modifying action without user’s consent such as making trades, transfers, withdrawals etc.
Subdomain takeover (only applies to main Hydration web app)
Out of scope
- Best practice critiques
- DDoS vulnerabilities
- Feature requests
- Issues related to the frontend without concrete impact and PoC
- Best practices issues without concrete impact and PoC
Blockchain/DLT specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers