TruFin builds institutional-grade liquid staking and tokenised RWAs vaults infrastructure. Its TruStake vaults let whitelisted, KYC'd users stake SOL on Solana, receiving reward-bearing receipt tokens (TruSOL) redeemable for the underlying stake plus rewards.
PoC Required
KYC required
Rewards
Rewards by Threat Level
Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.
Repeatable Attack Limitations
In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.
Public Disclosure of Known Issues
Bug reports covering previously discovered bugs acknowledged below are not eligible for any reward through the bug bounty program.
- Slashing is only enabled for Injective. Any issue related to slashing for other stakers will not be considered.
- Apart from the Solana staker, all TruFin stakers offer an allocation feature that enables a user to allocate rewards from the staked token. The amount allocated may exceed the total value currently staked by the user, which is fine. The user will still be required to have enough tokens in their wallet at the point at which distributions are made, hence no issue related to users not having enough to cover allocation’s distributions will be considered a bug.
Proof of Concept (PoC) Requirements
A PoC is required for the following severity levels:
- Smart Contract - Critical
- Smart Contract - High
- Smart Contract - Medium
All PoCs submitted must comply with the Immunefi-wide PoC Guidelines and Rules. Bug report submissions without a PoC when a PoC is required will not be provided with a reward.
Reward Payment Terms
Payouts are handled by the Trufin team directly and are denominated in USD. However, payments are done in USDC.
Program Overview
The TruFin Protocol builds institutional-grade DeFi primitives that can be used as the foundational building blocks for complex digital asset strategies to reduce risk while generating rewards, securely on-chain.
TruStake vaults provide access to liquid staking on the Solana network. In exchange for depositing assets in a TruStake vault, users receive the liquid staking token TruSOL.
This bug bounty program covers the TruStake smart contracts and whitelists listed in scope, and is primarily concerned with the loss of user funds. The program follows the Primacy of Rules: only the assets and impacts listed in scope are eligible.
Rewards are allocated based on the severity of the bug disclosed. The scope, terms and rewards are at the sole discretion of the TruFin Protocol.
For more information about TruFin, please visit https://trufin.io.
TruFin provides rewards in USDC. For more details about the payment process, please view the Rewards by Threat Level section.
Primacy of Rules
This program adheres to the Primacy of Rules. Only the assets and impacts listed in the Scope section of this program are eligible for a reward, and every report is bound by the terms of this bug bounty program.
- A report is eligible only if it affects an in-scope asset and demonstrates an in-scope impact.
- Assets owned by TruFin that are not listed as in-scope are not covered, even if the impact is critical.
- Other TruFin projects are not covered by this program. Check whether they have their own bug bounty program on Immunefi.
- Testnet and mock files are not covered.
- Rewards are determined by the severity classification and terms set out in this program, at the sole discretion of TruFin Protocol.
Immunefi Standard Badge
TruFin has satisfied the requirements for the Immunefi Standard Badge, which is given to projects that adhere to our best practices.
Audits
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.