Tinyman AMM v2.0 Protocol Bug Bounties

Assets in Scope

Target	Type	Added on
	Smart Contract - pool_template	28 November 2022
	Smart Contract - amm_clear_stat	28 November 2022
	Smart Contract - amm_approval	28 November 2022

Target

Type

Smart Contract - pool_template

Added on

28 November 2022

Target

Type

Smart Contract - amm_clear_stat

Added on

28 November 2022

Target

Type

Smart Contract - amm_approval

Added on

28 November 2022

Impacts in Scope

Critical	Direct theft of any user funds
Critical	Permanent freezing of user funds
Critical	Protocol insolvency
Critical	Modification/deletion of application
Critical	Taking signer authority of pool accounts
High	Theft of protocol fees
High	Permanent freezing of unclaimed protocol fees
High	Temporary freezing of user funds for at least 24 hours
High	Unauthorized updates to protocol parameters
Medium	Smart contract unable to operate due to lack of token funds
Medium	Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Medium	Making pool accounts pay unnecessary transaction fees

Severity

Critical

Title

Direct theft of any user funds

Severity

Critical

Title

Permanent freezing of user funds

Severity

Critical

Title

Protocol insolvency

Severity

Critical

Title

Modification/deletion of application

Severity

Critical

Title

Taking signer authority of pool accounts

Severity

High

Title

Theft of protocol fees

Severity

High

Title

Permanent freezing of unclaimed protocol fees

Severity

High

Title

Temporary freezing of user funds for at least 24 hours

Severity

High

Title

Unauthorized updates to protocol parameters

Severity

Medium

Title

Smart contract unable to operate due to lack of token funds

Severity

Medium

Title

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Severity

Medium

Title

Making pool accounts pay unnecessary transaction fees

View rewards

Out of scope

Program's Out of Scope information

The following vulnerabilities are excluded from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Centralization risks

The following activities are prohibited by this bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty