Immunefi
Symbiosis-logo

Symbiosis

Symbiosis is a cross-chain engine and interchain communication Protocol. Our know-how — any to any token swaps regardless of the blockchain networks, both EVM and non-EVM supported.

Avalanche
BSC
ETH
Polygon
Arbitrum
Base
Bitcoin
Boba Network
Cronos
Manta
Mantle
Metis
Rootstock
Sei
Sonic
Telos
TON
Tron
Defi
AMM
Maximum Bounty
$100,000
Live Since
18 August 2022
Last Updated
01 October 2026
  • PoC Required

Select the category you'd like to explore

Assets in Scope

Name
MetaRouterGateway
Added on
4 August 2022
Target
Name
MetaRouterGateway
Added on
4 August 2022
Target
Name
MetaRouterGateway
Added on
4 August 2022
Target
Name
MetaRouterGateway
Added on
4 August 2022

Impacts in Scope

Severity
Critical
Title

Direct theft of any user funds (ERC-20 tokens), whether at-rest or in-motion, other than unclaimed yield

Severity
Critical
Title

Permanent freezing of funds (ERC-20 tokens)

Out of scope

Program's Out of Scope information
  • Best practice critiques
Default Out of Scope and rules

Smart Contract specific

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Impacts requiring basic economic and governance attacks (e.g. 51% attack)
  • Lack of liquidity impacts
  • Impacts from Sybil attacks
  • Impacts involving centralization risks

All categories

  • Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
  • Impacts caused by attacks requiring access to leaked keys/credentials
  • Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
  • Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
  • Best practice recommendations
  • Feature requests
  • Impacts on test files and configuration files unless stated otherwise in the bug bounty program
  • Impacts requiring phishing or other social engineering attacks against project's employees and/or customers