NFTfi is the leading liquidity protocol for NFTs. NFTfi allows NFT owners to use the assets (NFTs) they own to access the liquidity they need by receiving secured loans from liquidity providers, peer-to-peer, in a completely trustless manner.

Direct theft of any user NFTs inside escrow in the loan contract

MerkleDistributors should not allow claims to the locking contract for addresses and amounts not specified in the MerkleRoot (note: funds can be drained by the contract owner at any time)

TokenLock contracts should not allow funds to be withdrawn to addresses  that did not lock the funds

NFTfi Codebase

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Reward Calculation for Critical Level Reports__

For critical smart contract bugs on testnet assets, the reward is paid as a flat amount of USD 20 000. This is because there are no actual funds at risk on the testnet, hence limits objective calculation. 


__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Public Disclosure of Known Issues__

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. 

- It is possible to create an offer with an editable bundle to steal customer's funds.

The `PermittedNFTsAndTypeRegistry` ([https://etherscan.io/address/0xadde73498902f61bfcb702e94c31c13c534879ac](https://etherscan.io/address/0xadde73498902f61bfcb702e94c31c13c534879ac)) defines which NFTs are permitted.

The following address is allowed: **0xf8CB0341563213BF33EaFFc7a6775Ed0Eb6c1401** (`NftfiBundler.sol`)

address bundle = hub.getContract(ContractKeys.NFTFI_BUNDLER);
require(_loanTerms.nftCollateralContract != bundle, "Collateral cannot be bundle");

[https://github.com/NFTfi-Genesis/nftfi.eth/blob/ae6625a0e9dbf4841bda279d0848d4b0512d6fb2/V2/contracts/loans/direct/loanTypes/DirectLoanFixedOffer.sol#L169C17-L169C17](https://github.com/NFTfi-Genesis/nftfi.eth/blob/ae6625a0e9dbf4841bda279d0848d4b0512d6fb2/V2/contracts/loans/direct/loanTypes/DirectLoanFixedOffer.sol#L169C17-L169C17)

In a practical scenario, the NFTfi frontend will not display offers from the `NftfiBundler.sol` collection but the deployed smart contracts do allow them to be created and accepted.

- Create offers with a wrapped collateral (that can be unwrapped) to steal user funds
The `wrapCollateral(...)` function inside the new `DirectLoanFixedOffer.sol` will:

1- Create an NFT that is wrapper for the asset in custody (which can be unwrapped and left empty)

2- Approve the wrapper in the `PermittedNFTsAndTypeRegistry`.

3- Update the loan and set this wrapper as the asset in escrow instead of the NFT.

After this loan finishes, the wrapper can be used in other loans - attacker front-runs user calls to `acceptOffer(...)` to empty the wrapper and sends them an empty wrapper.

In practice the NFTfi front-end will not display offers from this collection (the wrapper) but the deployed smart contracts do allow them to be created and accepted.

- It is possible to have some NFTs change ownership (and state) while in escrow such that the loan cannot be resolved (repaid or liquidated) - for example ENS domain names expiring and being re-registered by a new owner while the loan is in progress.

__Previous Audits__

NFTfi has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [https://drive.google.com/file/d/1gKMFWlhyPxYICTpNgCHJS4cgFrgB-h05/view?usp=drive_link](https://drive.google.com/file/d/1gKMFWlhyPxYICTpNgCHJS4cgFrgB-h05/view?usp=drive_link)
- Token audit - https://drive.google.com/file/d/1cJ6DAXcS_DqCJzeZ3w9CvdlWBiFvlBd0/view?usp=sharing

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract - Critical

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules). Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the NFTfi team directly and are denominated in USD. However, payments are done in USDC.

Title	Description	Link
NFTfi Codebase	Program Codebase
NFTfi Codebase	Program Codebase