All smart contracts of Mars Ecosystem can be found at [https://github.com/MarsEcosystem](https://github.com/MarsEcosystem). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.


The fundamental issue within most current stablecoin protocols is positive externality. The cost of producing and maintaining stablecoins are incurred by the protocol and its users (minters, share holders, bond holders). Whereas the majority of the value comes from the transaction The fundamental issue within most current stablecoin protocols is positive externality.

Low smart contract impact

Permanent freezing of unclaimed yield

Theft of unclaimed yield

Temporary freezing of funds

Injecting/modifying the static content on the target application without Javascript (Persistent) such as: HTML injection without Javascript, Replacing existing text with arbitrary text, Arbitrary file uploads, etc

Subdomain takeover without already-connected wallet interaction

Smart contract unable to operate due to lack of token funds

Unbounded gas consumption

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as: /etc/shadow, database passwords, blockchain key (this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user: Changing registration info, Commenting, Voting, Making trades, Withdrawals, Changing the NFT metadata

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions

__SMART CONTRACT__

__Theft of user funds:__ is a worst case scenario for a project. An example of in-motion funds is a swap. A user is transferring funds to the contract with the full expectation to exchange them for an equivalent value of another asset. If an attacker can manipulate the system in such a way that a user incurs losses during the transfer and the attacker profits, this is considered direct theft of user funds. If users are losing their stake, principal, vault balances, etc, that is theft of user funds.

__Permanent Freezing of funds:__ This includes bricking a contract which holds tokens so that a user is no longer able to withdraw their funds. It may also include burning of funds so that they can no longer be accessed by the owner. This also includes things like self-destructing implementation contracts so that the proxy becomes useless. The impact here is that funds within a system are no longer accessible.

__Protocol Insolvency:__ Some protocols provide yield to some users that is paid by other users (e.g. Compound lenders are owed yield that is provided by borrowers). An error in this calculation could result in the amount owed to users exceeding the amount owed by other users. This is insolvency. Alternatively, the protocol could have debts that exceed its assets in other ways. Of course this does not include "bank run" situations where it’s temporarily not possible to withdraw money from the protocol, but the protocol is otherwise adequately collateralized

__Theft of Unclaimed Yield:__  A yield is any asset distributed as a reward for participation in a system. Any theft of these rewards before they are distributed or claimed is classified as theft of an unclaimed yield.

__Permanent Freezing of Unclaimed Yield:__ A yield is any asset distributed as a reward for participation in a system. Whenever an attacker can prevent the yield from being able to move from the contract, for example by making the harvest() function always fail, this would mean the yield is permanently frozen.

__Temporary Freezing of Funds:__ This classification refers to temporary freezing of funds belonging to the protocol or another user, which the attacker does not own. There may be an amount of time or number of blocks which is in an acceptable range of operation for a project and is therefore excluded from consideration under this impact; however, this range of operation should be kept as short as possible because attacker locked funds can significantly impact user experience and cause rippling issues for a protocol. If an attacker needs to submit many costly transactions to achieve this impact, it is instead "Griefing" and is classified as "Medium".

__Smart contract unable to operate due to lack of token funds:__ This classification refers to bugs that mark the smart contract as unable to operate or work correctly due to lack of token funds. There may be cases where the smart contract cannot pay out any rewards for staked tokens because the contract doesn't hold any funds or won't accept any reimbursements. Another example would be the LINK token required to pay for certain Chainlink services. If those services are required for proper function of the system and it's possible (or likely) for the funds to be depleted, that would be a vulnerability.

__Unbounded gas consumption:__ Any looping done over an arbitrarily sized array may be vulnerable to unbounded gas consumption. If an attacker can add enough items to cause the gas used to call the function to exceed the block gas limit, it can result in a denial of service attack and prevent the function from being called.

__WEBSITES AND APPLICATIONS__

__Execute arbitrary system commands__ This impact refers to a security vulnerability in a website or application that allows an attacker to execute arbitrary commands on the underlying system. This type of vulnerability is often called arbitrary command injection. The impact of this vulnerability can be severe, as it provides the attacker with the ability to perform unauthorized actions on the affected system like Remote Command Execution (RCE).

__Retrieve sensitive data/files from a running server__ This impact allows an attacker to access and retrieve sensitive data or files from the affected server. This type of vulnerability is often called "information disclosure" or "data leakage." The impact of this vulnerability can be significant, as it exposes sensitive information that can be used for malicious purposes or further attacks.

__Taking down the application/website__ An attack that results in the disruption or complete unavailability of a website or application. This impact is different from DoS as it only refers to a vulnerability found in the application logic/code. When a website or application is taken down, it affects the user experience and the ability of users to access services and resources provided by the affected application. This can lead to customer dissatisfaction and potential loss of revenue for businesses that rely on the availability of their online services. The longer the downtime, the greater the potential negative impact on both users and the organization behind the website or application.

__Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user__ The attacker found a way to bypass the access control protection and arbitrarily update the other data without any interaction requirement. An attacker is able to perform actions that modify the state of the system or the network on behalf of other users, without the users' knowledge or consent.

__Subdomain takeover with already-connected wallet interaction__ This impact refers to a security vulnerability where an attacker gains control over a subdomain of a website or application, particularly one that interacts with users' connected cryptocurrency wallets. This takeover allows the attacker to manipulate the content and functionality of the subdomain, potentially leading to unauthorized interactions with the connected wallets.

__Direct theft of user funds__ It refers to a security vulnerability or an attack that results in the unauthorized transfer or misappropriation of users' digital assets, such as cryptocurrencies or tokens, directly from their wallets or accounts. One way someone can do this is by making unauthorized calls on the RPC. RPC is a communication method used to interact with blockchain nodes for sending transactions, querying data, and performing other actions. If there is a vulnerability or misconfiguration in the RPC implementation, an attacker might exploit it to directly steal user funds.

__Malicious interactions with an already-connected wallet__

  - _Modifying transaction arguments or parameters_
The attacker found a way to substitute the contract address with a malicious contract address stored at the frontend level.

  - _Substituting contract addresses_
The attacker found a way to modify the parameters of the transaction calls made to the wallet connected to the front end.

  - _Submitting malicious transactions_
The attacker found a way to inject malicious javascript code into the frontend that could initiate a malicious transaction to the wallet connected to the frontend

__Injecting/modifying the static content on the target application without Javascript (Persistent)__
The attacker discovered a method to persistently inject HTML code or plain text into the frontend, which could potentially deceive users visiting the frontend into providing sensitive keys, navigating to an external site controlled by the attacker, or falling for phishing 

__Subdomain takeover without already-connected wallet interaction__
The attacker found a way to claim or hijack the subdomain and inject a malicious code that could be used as a phishing vector for victims visiting the subdomain.


Mars Ecosystem Codebase

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System 3.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. 

All bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Bugs reported in the following audits are not eligible for a reward:

  - [SlowMist Audit](https://github.com/MarsEcosystem/mars-resource/blob/master/audit/SlowMist%20Audit%20Report%20-%20Mars%20Ecosystem%20-%20EN.pdf)
  - [CertiK Audit](https://github.com/MarsEcosystem/mars-resource/blob/master/audit/Certik%20Audit%20Report%20-%20Mars%20Ecosystem.pdf)

Payouts are handled by the __Mars Ecosystem__ team directly and are denominated in __USD__. However, payouts are done in __XMS__ or __BUSD__, at the discretion of the team.