Bug Bounty
Community engagement incentives
Last updated
Community engagement incentives
Last updated
The fundamental issue within most current stablecoin protocols is positive externality. The cost of producing and maintaining stablecoins are incurred by the protocol and its users (minters, shareholders, bondholders). Whereas the majority of the value comes from the transaction of stablecoins within DeFi primitives and is captured by these DeFi primitives.
Mars Ecosystem solves this problem by integrating the creation and the use of stablecoin into one stable yet decentralized ecosystem. The relationship between Mars Stablecoin and Mars DeFi platform creates a positive feedback loop and generates a flywheel effect.
Mars Stablecoin (USDm) is price stable, capital-efficient, scalable and decentralized. It is an over-backed stablecoin: the redeemability of USDm is backed by the Mars Ecosystem Governance Token (XMS). The market cap of XMS is always multiple times the market cap of Mars Stablecoin which ensures that the stablecoin can be redeemed 1:1 at any given time.
Mars Swap provides liquidity between Mars Stablecoin and all the other tokens, making USDm the ideal medium of exchange and store of value for DeFi. The incurred transaction fees generated at Mars Swap are used to back the stability of Mars Stablecoin.
This bug bounty program is focused on their smart contracts and app and is focused on preventing the following impacts:
Thefts and freezing of principal of any amount
Thefts and freezing of unclaimed yield of any amount
Theft of governance funds
Governance activity disruption
Website goes down
Leak of user data
Deletion of user data
Access to sensitive pages without authorization
Smart contracts fails to delivery promised returns based on APR
All bug submissions must go through Immunefi's bug submission process on the Marsecosystem bug bounty page
The Marecosystem bug bounty page can be viewed at:
https://immunefi.com/bounty/marsecosystem
When a hacker hits the "Submit bug report" button, they will be sent to bugs.immunefi.com which will guide them through the process of creating a bug report.
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.
All web/app bug reports must come with a PoC in order to be considered for a reward.
Bugs reported in the following audits are not eligible for a reward:
Payouts are handled by the Mars Ecosystem team directly and are denominated in USD. However, payouts are done in XMS or BUSD, at the discretion of the team.
Smart Contracts and Blockchain
Critical Up to $60,000
High $15,000
Medium $5,000
Low $1,000
Websites and Apps
Critical $10,000
High $5,000
Medium $1,000
All smart contracts of Mars Ecosystem can be found at https://github.com/MarsEcosystem. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
Impacts in Scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in the scope table.
Smart Contracts
Loss of user funds staked (principal) by freezing or theft
Loss of governance funds
Theft of unclaimed yield
Freezing of unclaimed yield
Temporary freezing of funds for any amount of time
Unable to call smart contract
Smart contract gas drainage
Smart contract fails to deliver promised returns
Vote manipulation
Incorrect polling actions
Web/App
Incorrect or unintended behavior relating to money. (ie. user input is for 10 USDC on the app, and we actually send 100 USDC to the smart contract)
We are pointing to an incorrect smart contract
Cross-site request forgery (CSRF)
Cross-site scripting (XSS)
We are especially interested in receiving and rewarding vulnerabilities of the following types:
Smart Contracts and Blockchain
Re-entrancy
Logic errors
including user authentication errors
Solidity/EVM details not considered
including integer over-/under-flow
including rounding errors
including unhandled exceptions
Trusting trust/dependency vulnerabilities
including composability vulnerabilities
Oracle failure/manipulation
Novel governance attacks
Economic/financial attacks
including flash loan attacks
Congestion and scalability
including running out of gas
including block stuffing
including susceptibility to frontrunning
Consensus failures
Cryptography problems
Signature malleability
Susceptibility to replay attacks
Weak randomness
Weak encryption
Susceptibility to block timestamp manipulation
Missing access controls / unprotected internal or debugging interfaces
Websites and Apps
Remote Code Execution
Trusting trust/dependency vulnerabilities
Vertical Privilege Escalation
XML External Entities Injection
SQL Injection
LFI/RFI
Horizontal Privilege Escalation
Stored XSS
Reflective XSS with impact
CSRF with impact
Direct object reference
Internal SSRF
Session fixation
Insecure Deserialization
DOM XSS
SSL misconfigurations
SSL/TLS issues (weak crypto, improper setup)
URL redirect
Clickjacking (must be accompanied with PoC)
Misleading Unicode text (e.g. using right to left override characters)
The following vulnerabilities are excluded from the rewards for this bug bounty program:
Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)
Smart Contracts and Blockchain
Incorrect data supplied by third party oracles
Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Websites and Apps
Theoretical vulnerabilities without any proof or demonstration
Content spoofing / Text injection issues
Self-XSS
Captcha bypass using OCR
CSRF with no security impact (logout CSRF, change language, etc.)
Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
Server-side information disclosure such as IPs, server names, and most stack traces
Vulnerabilities used to enumerate or confirm the existence of users or tenants
Vulnerabilities requiring unlikely user actions
URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
Lack of SSL/TLS best practices
DDoS vulnerabilities
Attacks requiring privileged access from within the organization
Feature requests
Best practices
The following activities are prohibited by this bug bounty program:
Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third-party systems and applications (e.g., browser extensions) as well as websites (e.g., SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty