IPOR refers to a set of protocols, smart contracts, and software that forms a set of Decentralized Applications (DApps) for Decentralized Finance (DeFi) focused on interest rate derivatives. The core IPOR infrastructure consists of three main parts: the IPOR Index (Index), Liquidity Pools with an Automated Market Maker (AMM) and Asset Management smart contracts.
Arbitrum
ETH
Defi
AMM
Asset Management
DEX
Derivatives
L2
Staking
Solidity
Maximum Bounty
$1,000Live Since
11 April 2023Last Updated
24 September 2026PoC Required
Select the category you'd like to explore
Assets in Scope
Target
Primacy Of Impact
Name
Added on
5 October 2023
Impacts in Scope
Severity
Critical
Title
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Severity
Critical
Title
Permanent freezing of funds
Out of scope
Program's Out of Scope information
- Broken link hijacking is out of scope
- Best practice critiques
- IPOR index value manipulation through AAVE & Compound
- Issues when the liquidity of liquidity pools equals zero
- Interest Rate Swaps opening and closing
Default Out of Scope and rules
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers