Runnable PoC Required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Severity
Critical
Title
An oracle accepts a price update without a valid Pyth or Chainlink signature, or a compressed-feed push from an unauthorized pusher
Severity
Critical
Title
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Severity
Critical
Title
Protocol insolvency
Severity
High
Title
Bypassing the admin fee caps or the price-provider timelock.
Severity
High
Title
Swap on a Metric anchored price provider pool executes outside the band or beyond its configured staleness limit
Severity
High
Title
Unauthorized use of protocol roles: factory owner, oracle ADMIN_ROLE, propAMM adapter admin
Severity
High
Title
Permanent freezing of funds
Severity
High
Title
Temporary freezing of funds
Severity
High
Title
Theft of unclaimed yield
Severity
High
Title
Theft of unclaimed royalties
Severity
High
Title
Permanent freezing of unclaimed yield
Severity
High
Title
Permanent freezing of unclaimed royalties
Out of scope
Program's Out of Scope information
Additional Out of Scope Information
The following are out of scope and not eligible for rewards:
- Trusted roles and configuration
- Issues requiring a malicious, compromised or careless trusted role: Factory Owner, Oracle ADMIN_ROLE (blacklist, integrators, approved factories, registration fee, withdrawEth), and the PriceProvider / AnchoredProvider factory admins.
- Pool Admin actions within their allowed bounds (admin fees up to the cap, timelocked price-provider changes, pausing their own pool, bin and extension settings). Only bypassing the caps or an honestly configured timelock is in scope, and only at Medium severity or higher.
- Pools created or configured with unreasonable or malicious parameters. Users are expected to do their own due diligence; pool risk tiers (red, unverified curator, unverified price provider) are informational.
- Oracles and off-chain components
- Incorrect, manipulated or stale prices from oracle providers (Chainlink, Pyth, compressed or pushed oracles) or from off-chain pushers and signers. Oracle data is assumed correct and fresh.
- Pools halting because a feed is stale or down (FeedStalled, staleness checks, Chainlink deviation or sequencer checks). This is intended behaviour, not denial of service.
- Off-chain infrastructure: price pushers, quote and maker services (including protected execution lanes and pamm-quote), keepers, indexers, the API (api.metric.xyz), SDK, app, admin dashboard and docs.
- Tokens and third-party code
- Non-standard ERC-20 tokens: fee-on-transfer, rebasing, tokens with transfer hooks (ERC-777), tokens with fewer than 6 or more than 18 decimals, tokens that revert on zero transfers. USDC and USDT are in scope; the effect of their issuers blocklisting an address is not.
- Price providers, sources and extensions written and deployed by third parties, and anything that depends on them.
- External protocols and routers (aggregators, other DEXes, routes through externalSwap / ExternalSwapExecutor). Losses caused by external routers or integrators, including insufficient gas limits, are out of scope.
- Market and execution risk
- Front-running, sandwiching and other MEV within the user's slippage or deadline settings; gas griefing; block stuffing; reorgs; sequencer or builder behaviour.
- Liquidity-provider losses from normal market risk: adverse selection, unfavourable price-provider or spread settings, impermanent loss.
- Rounding dust or precision loss below the Medium threshold (0.01% and $10), unless it can be repeated to reach Medium or higher.
- Already known or not deployed
- Issues listed in previous audits or known-issue documents, and any report sharing a root cause with them. https://github.com/Metricxyz/Known_issues for all known issues.
- Contracts not listed as in-scope assets, superseded or deprecated deployments, test files, mocks, scripts, deployment tooling and testnet deployments.
- Issues in code that is not deployed, or already fixed in the deployed version.
- General exclusions
- Gas optimisations, code style, missing events, informational or best-practice findings, and centralisation concerns about trusted roles.
- Attacks requiring stolen private keys, phishing, social engineering or physical access; denial-of-service on websites or APIs; rate-limit or spam issues on off-chain services.
- Bugs in the underlying blockchain, the EVM, compilers or standard libraries (e.g. OpenZeppelin), unless Metric's code uses them incorrectly.
- Severity and feasibility rules
- Critical requires at least $10,000 of funds directly at risk; otherwise the report is assessed as High at most.
- Attacks that require a user to interact with a pool, extension or price provider created by the attacker are downgraded by one severity level.
- Immunefi’s standard feasibility limitations apply, including Attack Investment Amount: if the capital required exceeds the potential gain, severity may be downgraded.
- Reports must include a runnable proof of concept on a local fork. Testing against mainnet or testnet deployments is prohibited.
Default Out of Scope and rules
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers