Mars Protocol Bug Bounties | Immunefi

Target	Type	Added on
	Smart Contract - Pertaining to Mars Outposts which are are deployed on the Osmosis and Neutron blockchains	31 January 2023

Target

Type

Added on

Smart Contract - Pertaining to Mars Outposts which are are deployed on the Osmosis and Neutron blockchains

31 January 2023

Critical	Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Critical	Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties
Critical	Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)
Critical	Protocol insolvency
Critical	Oracle manipulation and flash loan attacks
High	Theft of unclaimed royalties
High	Freezing of funds
High	Freezing of NFTs (applicable for v2-fields-of-mars/rover only)
Medium	Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Medium	Freezing of unclaimed yield
Medium	Freezing of unclaimed royalties
Low	Unintended consequences from Maximal-extractable value (MEV) exploration

Critical

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Critical

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Critical

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Critical

Protocol insolvency

Critical

Oracle manipulation and flash loan attacks

High

Theft of unclaimed royalties

High

Freezing of funds

High

Freezing of NFTs (applicable for v2-fields-of-mars/rover only)

Medium

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Medium

Freezing of unclaimed yield

Medium

Freezing of unclaimed royalties

Low

Unintended consequences from Maximal-extractable value (MEV) exploration

Program's Out of Scope information

The following vulnerabilities are excluded from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)
Attacks found in an underlying Cosmos SDK standard module dependency (vulnerabilities found in code that is not Mars Protocols code, but Mars Protocol has a dependency on through Cosmos SDK)

Smart Contracts and Blockchain

Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Centralization risks
Lack of funding for contracts that require topping up from an external address e.g.contracts pertaining to incentives e.t.c. (where applicable)
DoS related attacks

The following activities are prohibited by this bug bounty program:

Any testing with mainnet contracts; all testing should be done on private testnets. Any testing on public testnets should be done with care to not disclose vulnerabilities to blackhats.
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty