Mars Protocol
Mars Protocol consists of a money market, called Red Bank, and a generalized credit primitive called Credit Accounts. Mars Protocol utilizes a so-called hub and outpost topology, whereby its base, Mars Hub - - which is an instance of DAO on Neutron is the command center for Mars outposts. Each outpost can consist of instances of Red Bank and/or Credit Accounts.
PoC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties
Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)
Protocol insolvency
Oracle manipulation and flash loan attacks
Theft of unclaimed royalties
Freezing of funds
Freezing of NFTs (applicable for v2-fields-of-mars/rover only)
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Freezing of unclaimed yield
Freezing of unclaimed royalties
Unintended consequences from Maximal-extractable value (MEV) exploration
Out of scope
- Attacks found in an underlying Cosmos SDK standard module dependency (vulnerabilities found in code that is not Mars Protocols code, but Mars Protocol has a dependency on through Cosmos SDK)
- Best practice critiques
- Lack of funding for contracts that require topping up from an external address e.g.contracts pertaining to incentives e.t.c. (where applicable)
- DoS related attacks
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers
70k