Mantle LSP
Mantle Liquid Staking Protocol (LSP) is a permissionless, non-custodial ETH liquid staking protocol deployed on Ethereum L1 and governed by Mantle. Mantle Staked Ether (mETH) serves as the value-accumulating receipt token.
PoC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Permanent freezing of staked funds
Protocol insolvency
Theft of unclaimed yield or tokenized staking yield
Permanent freezing of unclaimed or tokenized staking yield
Acquiring owner/admin rights without contract’s owner/admin action
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Unbounded gas consumption
Susceptibility to frontrunning
Out of scope
- Any issues identified in Published Audits https://docs.mantle.xyz/meth/security/audits
- Impact of future improper configuration of contracts that are not deployed
- Impacts from an assumption of a malicious majority of oracles
- Gas optimization
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers