Ondo Finance
Ondo Finance brings exposure to US Treasuries on-chain, making it possible for token holders to earn yield daily with highly liquid, bankruptcy-remote, tokenized assets. Ondo significantly broadens the investor base that can capitalize on these yields and put their assets to work in blockchain-based applications, while reducing the friction experienced when converting between stablecoins and tokenized traditional assets.
PoC required
KYC required
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3.
Reward Calculation for Critical Level Reports
For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 1 000 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 50 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.
Repeatable Attack Limitations
In cases of repeatable attacks for smart contract bugs, the amount of funds at risk will be calculated within the first 45 minutes from the first attack, inclusive, no matter how many times the attack can be executed within that time frame, as demonstrated by the PoC provided by the security researcher.
Example 1: vulnerability is discovered that can steal USD 1 million 30 times within 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 30 million.
Example 2: if a vulnerability is discovered that can steal USD 1 million once every 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 1 million.
However, for smart contracts directly holding funds that can’t be protected, if a discovered vulnerability includes the temporary locking of funds that could otherwise be withdrawn and thus prevented from being stolen but still accessible to the exploiter to take the funds, the time is extended to the exact same time as temporary locking. Extensions of the temporary locking that introduce a gap where withdrawals can happen will not be considered.
Reward Calculation for High Level Reports
-
High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 11 000 to USD 50 000 depending on the funds at risk, capped at the maximum high reward.
-
In the event of temporary freezing, the reward doubles from the full frozen value for every additional [24h] that the funds are temporarily frozen, up until a max cap of the high reward. This is because as the duration of the freezing lengthens, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature.
Reward Payment Terms Payouts are handled by the Ondo Finance team directly and are denominated in USD. However, payments are done in USDC on Ethereum based on an implied USD:USDC exchange rate of 1:1.
Program Overview
Ondo Finance brings exposure to US Treasuries on-chain, making it possible for token holders to earn yield daily with highly liquid, bankruptcy-remote, tokenized assets. Ondo significantly broadens the investor base that can capitalize on these yields and put their assets to work in blockchain-based applications, while reducing the friction experienced when converting between stablecoins and tokenized traditional assets.
Qualifying purchasers receive tokenized assets which are transferable on-chain, including through approved smart contracts, paving the way for a compliant on-chain financial ecosystem powered by real world assets.
For more information about Ondo Finance, please visit https://ondo.finance/
Ondo Finance provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below.
KYC Requirement
Ondo Finance will be requesting KYC information in order to pay for successful bug submissions. The following information will be required:
- Full name
- Date of birth
- Proof of address (either a redacted bank statement with address or a recent utility bill)
- Copy of Passport or other Government issued ID
Eligibility Criteria
Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFACs SDN list
- Official contributor, both past or present
- Employees and/or individuals closely associated with the project
- Compensated team members of Ondo Finance or any of its affiliates;
- Third-party vendors, suppliers and service providers to Ondo Finance or any of its affiliates, and team members of those third parties;
- Businesses or organizations that are not Ondo Finance affiliates but hold or have held assets considered as critical infrastructure covered under the bug bounty program; third-party vendors, suppliers and service providers to those business or organizations; and team members of those business, organizations or third parties; and
- Security auditors that directly or indirectly participated in the review of the code impacted, except for auditors that solely participated in crowdsourced/competitive audits sponsored by Ondo Finance.
Responsible Publication
Ondo Finance adheres to category 3 - Approval Required. This Policy determines what information researchers are allowed to make public from their submitted bug reports. For more information about the category selected, please refer to our Responsible Publication page.
Primacy of Impact vs Primacy of Rules
Ondo Finance adheres to the Primacy of Impact for the following impacts, subject to the provisions of this section of Ondo’s Program:
- Smart Contract - Critical
Primacy of Impact means that the impact is prioritized rather than a specific asset. This encourages security researchers to report on all bugs with an in-scope impact, even if the affected assets are not in scope. For more information, please see Best Practices: Primacy of Impact
When submitting a report on Immunefi’s dashboard, the security researcher should select the Primacy of Impact asset placeholder. If the team behind this project has multiple programs, those other programs are not covered under Primacy of Impact for this program. Instead, check if those other projects have a bug bounty program on Immunefi.
If the project has any testnet and/or mock files, those will not be covered under Primacy of Impact.
For any impact that would be eligible for a reward based on the Primacy of Impact approach, but otherwise would not be eligible for a reward, the amount of the reward will be at Ondo Finance’s discretion. Rewards will not be provided for impacts that are out of scope, or where the limitations of this Program otherwise apply.
All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms and conditions set within this program.
Proof of Concept (PoC) Requirements
All bug reports must come with a PoC with one or more Impacts in Scope on one or more Assets in Scope in order to be considered for a reward. Explanations and statements are not sufficient as PoC; bug reports must include a runnable PoC in order to prove impact. Exceptions may be made, at Ondo Finance’s discretion, in cases where the vulnerability is objectively evident; however, the bug reporter may be required to provide a PoC at any point in time. In addition to these requirements, all PoCs submitted must demonstrate a good-faith effort to comply with the Immunefi-wide PoC Guidelines and Rules. Bug report submissions without a PoC when a PoC is required will not be provided with a reward.
Public Disclosure of Known Issues
Bug reports covering previously discovered bugs (listed below) are not eligible for a reward within this program. This includes known issues that the project is aware of but has consciously decided not to “fix”, necessary code changes, or any implemented operational mitigating procedures that can lessen potential risk.
- Profiting from purchasing OUSG or USDY before a price increase and then immediately selling after. This includes using MEV and flash loans.
- Effects from large price swings in the SHV ETF, which may constrain the prices at which OUSG can be set to
- Effects from allowlists or blocklists (e.g. KYC Registry, USDC blacklist, Chainalysis Sanctions Oracle, USDY Blocklist, BUIDL Whitelist, etc.)
- Effects from the BUIDL token being seized by the issuer or configured in a way that interferes with OUSGInstantManager Redemptions
- Users unable to perform instant redemptions because there is not enough USDC or BUIDL in the OUSGInstantManager contract
- Users unable to perform instant redemptions because there is not enough USDC liquidity available for the BUIDL token
- Effects from USDC depegging
- Misuse of admin rights (malicious or accidental)
- Taking advantage of rate limits to DDOS subscriptions, redemptions or bridges
- Minimum redemption amounts prohibiting a user from performing a redemption
- Minor imprecision stemming from rebasing tokens or differences in decimals. This includes intentional and unintentional dust accumulation in the form of token balances and rebasing token “shares.”
- Front running permissioned setter functions that pertain to fees
- Front running permissioned override functions for subscription or redemption state in OUSG Manager and USDY Manager
Previous Audits
Ondo Finance’s completed audit reports can be found below. Any issues mentioned in the following reports, including but not limited to unfixed vulnerabilities, are not eligible for a reward. For Code4rena Audits, findings in the competition READMEs and findings repositories are also not eligible for a reward.
- April 2024 Code4rena Audit
- April 2024 Cyfrin Audit
- September 2023 Code4rena Audit
- August 2023 Zokyo Audit
- April 2023 NetherMind Audit
- January 2023 Code4rena Audit
Feasibility Limitations
Bug reports that require an attack that involve one or more other protocols (e.g. utilizing flash loans from a margin protocol or manipulating the spot prices on a DEX), either to make an attack more severe than it would be in isolation, or to achieve an attack that would otherwise be impossible or infeasible, will be downgraded or rejected entirely, in Ondo Finance’s discretion. However, they will be considered as in-scope and categorized according to the program rules as long as ALL of the following are true:
- Losses or other negative effects of the attack are inflicted upon Ondo ecosystem participants.
- The additional protocols used must have enough liquidity in various assets to allow the attack to succeed at the time of bug report submission. For example: if an attack requires an ETH flash loan, but the amount is larger than all the ETH available for loan across the ecosystem, then this would not be satisfied.
- The attack doesn’t include a dependency on an oracle price update.
Immunefi Standard Badge
By adhering to Immunefi’s best practice recommendations, Ondo Finance has satisfied the requirements for the Immunefi Standard Badge.
Other Terms
The Terms of Use between each participant in this bug bounty program and Immunefi Software Pte. Ltd., available at https://immunefi.com/terms-of-use/, shall apply between the participant and Ondo as if the participant were “you” or “User”, as if Ondo were “Company”, “we”, “our” or “us”, and as if “Interface”, “Website” and “Platform” referred only to the portions thereof that are applicable to this bug bounty program (except for Sections 7, 8, 11, 23, the first two paragraphs of Section 1 and the first paragraph of Section 12).
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.