USDY Token (Standard SPL Token on Solana)

If an impact can be caused to any other asset managed by Ondo Finance that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project.

Documentation and further resources can be found on https://docs.ondo.finance/. 

For the USDY Token (Noble) asset, please refer to https://github.com/ondoprotocol/usdy-noble for the source code.

Ondo Finance brings exposure to US Treasuries on-chain, making it possible for token holders to earn yield daily with highly  liquid, bankruptcy-remote, tokenized assets. Ondo significantly broadens the investor base that can capitalize on these yields and put their assets to work in blockchain-based applications, while reducing the friction experienced when converting between stablecoins and tokenized traditional assets.

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol Insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Ability to bypass contract paused state

Temporary freezing of funds for at least 24 hours

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Bypassing blocklists, sanctions list, or allowlists, successfully allowing blocked actors to acquire OUSG or USDY tokens or rebasing versions of the same (note: use of wrappers does not constitute a bypass)

Bypassing the Noble USDY IBC channel blocklist, successfully allowing USDY on Noble to be bridged out through a blocked channel via IBC (note: use of wrappers does not constitute a bypass)

Smart contract failure to deliver promised returns (but without losing value)

Theft of gas

If an impact can be caused to any other asset managed by Ondo Finance that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for consideration by the project.

Documentation and further resources can be found on https://docs.ondo.finance/. 

For the USDY Token (Noble) asset, please refer to https://github.com/ondoprotocol/usdy-noble for the source code.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). 

__Reward Calculation for Critical Level Reports__

For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 1 000 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 50 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, the amount of funds at risk will be calculated within the first 45 minutes from the first attack, inclusive, no matter how many times the attack can be executed within that time frame, as demonstrated by the PoC provided by the security researcher.

Example 1: vulnerability is discovered that can steal USD 1 million 30 times within 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 30 million.

Example 2: if a vulnerability is discovered that can steal USD 1 million once every 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 1 million.

However, for smart contracts directly holding funds that can’t be protected, if a discovered vulnerability includes the temporary locking of funds that could otherwise be withdrawn and thus prevented from being stolen but still accessible to the exploiter to take the funds, the time is extended to the exact same time as temporary locking. Extensions of the temporary locking that introduce a gap where withdrawals can happen will not be considered.

__Reward Calculation for High Level Reports__

- High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 11 000 to USD 50 000 depending on the funds at risk, capped at the maximum high reward.  

- In the event of temporary freezing, the reward doubles from the full frozen value for every additional [24h] that the funds are temporarily frozen, up until a max cap of the high reward. This is because as the duration of the freezing lengthens, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature.

__Reward Payment Terms__
Payouts are handled by the Ondo Finance team directly and are denominated in USD. However, payments are done in USDC on Ethereum based on an implied USD:USDC exchange rate of 1:1.

Ondo Finance

Resources & Documentation