Thala Protocol

Thala is a suite of decentralized finance (DeFi) primitives serving as the backbone of the Aptos ecosystem. The protocol revolves around three modules: AMM, CDP, and LST.

For more information about Thala Protocol, please visit https://www.thalalabs.xyz/.

Thala Protocol provides rewards in USDC on Aptos, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below.

Closed Source BBP

This program is designed for security researchers to review the project’s system from a black-box perspective. Researchers will perform penetration testing on local copies of the blockchain without access to the source code.

The project will provide a dedicated testing framework where all Proofs of Concept (PoCs) must be written and executed. Submitting a valid PoC is required to be eligible for rewards. PoCs will be tested by the project and, if applicable, by the triage team (in the case of managed triaging) or during mediation. This process ensures verification of reported bugs and confirmation that the claimed impact can indeed be achieved.

KYC Requirement

Thala Protocol will be requesting KYC information in order to pay for successful bug submissions. The following information will be required:

• Full name
• Date of birth
• Proof of address (either a redacted bank statement with address or a recent utility bill)
• Copy of Passport or other Government issued ID

Eligibility Criteria

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:

• On OFACs SDN list
• A contracted technical contributor who is being directly compensated by the project or directly compensated by a contracted organization providing technical services to the project.
• A former contracted technical contributor who, for the past year from the date of the bug report submission, was directly compensated by the project or was compensated by a contracted organization to the project. In the case of the latter, the status of the organization’s contract with the project is irrelevant.

Primacy of Impact vs Primacy of Rules

Thala Protocol adheres to the Primacy of Impact for the following impacts:

• Smart Contract — Critical
• Smart Contract — High
• Smart Contract — Medium
• Smart Contract — Low

Primacy of Impact means that the impact is prioritized rather than a specific asset. This encourages security researchers to report on all bugs with an in-scope impact, even if the affected assets are not in scope.

For more information, please see Best Practices: Primacy of Impact

When submitting a report on Immunefi’s dashboard, the security researcher should select the Primacy of Impact asset placeholder. If the team behind this project has multiple programs, those other programs are not covered under Primacy of Impact for this program. Instead, check if those other projects have a bug bounty program on Immunefi.

If the project has any testnet and/or mock files, those will not be covered under Primacy of Impact. All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms and conditions set within this program.

Proof of Concept (PoC) Requirements

A PoC, demonstrating the bug's impact, is required for this program and has to comply with the rules below.

• All Proofs of Concept must be implemented using the AptosBB framework. Submissions relying on alternative tools, scripts, or methods shall be deemed invalid and will not be accepted.
• Researchers must clone the AptosBB repository, clear the contents of the pentest.rs file, and implement their PoC therein. The PoC must demonstrate the exploit in an isolated, local environment, consistent with the framework’s intended design
• Manual alteration of the WriteSet, or any modification of behaviors not reproducible on the target system in a remote execution scenario, is strictly prohibited. Any such modifications shall render the submission void.
• All submitted PoCs must replicate an end-to-end exploit against the target contract and clearly demonstrate the security impact. Submissions that fail to show demonstrable, reproducible impact shall not qualify for reward consideration.