Lido on Polygon

Lido on Polygon, developed in collaboration with Shard Labs, is a liquid staking solution for MATIC.

Polygon

Defi

Liquid Staking

Solidity

Maximum Bounty

$2,000,000

Live Since

31 March 2022

Last Updated

18 November 2024

PoC required

Submit a Bug

Information Scope Resources

Select the category you'd like to explore

Assets in Scope

Target	Type	Added on
	Smart Contract - StMATIC	31 March 2022
	Smart Contract - NodeOperatorRegistry	31 March 2022
	Smart Contract - PoLidoNFT	31 March 2022
	Smart Contract - FxBaseChildTunnel	31 March 2022
	Smart Contract - FxBaseRootTunnel	31 March 2022
	Smart Contract - FxStateChildTunnel	31 March 2022
	Smart Contract - FxStateRootTunnel	31 March 2022
	Smart Contract - lido_nft_proxy	31 March 2022
	Smart Contract - lido_nft_impl	31 March 2022
	Smart Contract - stMATIC_proxy	31 March 2022
	Smart Contract - stMATIC_impl	31 March 2022
	Smart Contract - node_operator_registry_proxy	31 March 2022

Target

Type

Smart Contract - StMATIC

Added on

31 March 2022

Target

Type

Smart Contract - NodeOperatorRegistry

Added on

31 March 2022

Target

Type

Smart Contract - PoLidoNFT

Added on

31 March 2022

Target

Type

Smart Contract - FxBaseChildTunnel

Added on

31 March 2022

Target

Type

Smart Contract - FxBaseRootTunnel

Added on

31 March 2022

Target

Type

Smart Contract - FxStateChildTunnel

Added on

31 March 2022

Target

Type

Smart Contract - FxStateRootTunnel

Added on

31 March 2022

Target

Type

Smart Contract - lido_nft_proxy

Added on

31 March 2022

Target

Type

Smart Contract - lido_nft_impl

Added on

31 March 2022

Target

Type

Smart Contract - stMATIC_proxy

Added on

31 March 2022

Target

Type

Smart Contract - stMATIC_impl

Added on

31 March 2022

Target

Type

Smart Contract - node_operator_registry_proxy

Added on

31 March 2022

Impacts in Scope

Critical	Any governance voting result manipulation
Critical	Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Critical	Miner-extractable value (MEV)
Critical	Permanent freezing of funds
Critical	Insolvency
Critical	Theft of unclaimed yield
Critical	Ability to execute system commands
Critical	Extract Sensitive data/files from the server such as /etc/passwd
Critical	Taking down the application/website
Critical	Stealing User Cookies
Critical	Signing transactions for other users
Critical	Redirection of user deposits and withdrawals

Severity

Critical

Title

Any governance voting result manipulation

Severity

Critical

Title

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Severity

Critical

Title

Miner-extractable value (MEV)

Severity

Critical

Title

Permanent freezing of funds

Severity

Critical

Title

Insolvency

Severity

Critical

Title

Theft of unclaimed yield

Severity

Critical

Title

Ability to execute system commands

Severity

Critical

Title

Extract Sensitive data/files from the server such as /etc/passwd

Severity

Critical

Title

Taking down the application/website

Severity

Critical

Title

Stealing User Cookies

Severity

Critical

Title

Signing transactions for other users

Severity

Critical

Title

Redirection of user deposits and withdrawals

View rewards

Out of scope

Program's Out of Scope information

Best practice critiques

Default Out of Scope and rules

Smart Contract specific

Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
Impacts requiring basic economic and governance attacks (e.g. 51% attack)
Lack of liquidity impacts
Impacts from Sybil attacks
Impacts involving centralization risks

All categories

Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
Impacts caused by attacks requiring access to leaked keys/credentials
Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
Best practice recommendations
Feature requests
Impacts on test files and configuration files unless stated otherwise in the bug bounty program
Impacts requiring phishing or other social engineering attacks against project's employees and/or customers

Submit a Bug

Severity

Min. - Max.

Critical

$40k -$2M

High

$7.5k -$400k

Medium

$3.2k -$100k

Low

$1k

Total Assets in Scope

Total Impacts in Scope