Circuit is a DeFi protocol built on the Chia blockchain.

Specifically, Circuit is a collateralized debt position (CDP) protocol that allows users to borrow Bytecash (BYC), a USD stablecoin issued by the protocol, against XCH, the native token of Chia.


For more information about CircuiDAo, please visit [https://docs.circuitdao.com/](https://docs.circuitdao.com/).

Circuit rewards are denominated in USD and distributed in USDC on Ethereum



Temporary freezing of funds for at least 24 hours

Permanent freezing of funds

Predictable or manipulable RNG that results in abuse of the principal or NFT

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Contract fails to deliver promised returns, but doesn't lose value

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Temporary freezing of funds for at least 1 hour

Permanent significant depeg of stablecoin (BYC), e.g. by forcing undercollateralization

Oracle price manipulation without assuming data providers are untrustworthy or can be attacked off-chain

Theft of funds from protocol treasury

Temporary significant depeg of stablecoin (BYC) for at least 24  hours, e.g. by forcing undercollateralization

Temporary significant depeg of stablecoin (BYC) for at least 1 hour, e.g. by forcing undercollateralization

__Where might Security Researchers confuse out-of-scope code to be in-scope?__

N/A. There shouldn’t be any confusion. 


__Is this an upgrade of an existing system? If so, which? And what are the main differences?__

No. As a CDP protocol, we have taken some inspiration from MakerDAO, both the initial single-collateral DAI system as well as some innovations of the multi-collateral version such as Dutch liquidation auctions. However, the implementation is completely different due to Chia’s coinset (UTXO) model and Chialisp as smart contract language.


__Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?__

See the list of in-scope bugs below. The higher the severity, the more concerned we are about the respective exploit.


__What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported?__

The protocol makes use of Chia Asset Token (CAT) standard (https://chialisp.com/cats/), singletons (https://chialisp.com/singletons/) and various custom coin types. An overview can be found here: https://docs.circuitdao.com/technical-manual/overview#list-of-protocol-coins

__What emergency actions may you want to use as a reason to downgrade an otherwise valid bug report?__

Mitigation measures that can be taken by governance. As an (out-of-scope) example, if Announcers collude to manipulate the Oracle price, governance can swap out the Oracle by updating the ORACLE_LAUNCHER_ID Statute within STATUTES_PRICE_DELAY. 

__What addresses would you consider any bug report requiring their involvement to be out of scope, as long as they operate within the privileges attributed to them?__

None

__What addresses would you consider any bug report requiring their involvement be out of scope, even if they exceed the privileges attributed to them?__

None

__Which chains and/or networks will the code in scope be deployed to?__

The project will eventually be deployed on Chia (mainnet and testnet11). 

__What external dependencies are there?__

See the pyproject.toml files in ‘puzzles’ and ‘circuit’ Github repos.
In terms of security context, the Chialisp code from ‘puzzles’ repos will get deployed on Chia mainnet. We will run a Chia fullnode service to connect the dapp backend to the blockchain.

__Are there any unusual points about your protocol that may confuse Security Researchers?__

The protocol differs from many other DeFi projects is that governance is done completely on-chain by governance token (CRT) holders. Governance proposals are created, vetoed on, and implemented (“enacted”) on-chain. There is no governance multi-sig (controlled by a foundation or otherwise).

The protocol is largely immutable, with governance being limited to changing the value of certain parameters (“Statutes”) or outputting custom conditions. The one exception to this is the Oracle singleton, which governance can replace entirely (by changing the value of the Oracle launcher ID at Statutes index 0)

__What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc)__

Documentation for Circuit protocol can be found at: https://docs.circuitdao.com/
Note that the documentation is not up-to-date with the latest commit and contains inaccurate descriptions in several places. However, the docs should work well as an introduction to and general overview of the protocol.

SRs may also be interested in the audit report by Zellic: 

Chialisp-related documentation can be found at: https://chialisp.com/

The protocol makes use of modern chialisp features: https://chialisp.com/modern-chialisp/

Rewards are distributed among SRs according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

Total budget: **$10,000** broken down as follows:


**Reward pool:**

If bugs are found → USD $6k (see [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms))

If only Insights are found → USD $900 (9% of the Reward pool)

**Guaranteed rewards:**
$2k per SR → $4k total (for 2 SRs)

Duplicate submissions of bugs are valid. Duplicate submissions of Insights are invalid.

**Proof of Concept (PoC) Requirements**

For this program, runnable PoC code is not required. Whitehats are instead required to write a step-by-step explanation of the PoC and impact.
Read our [New Audit Competition Proof-of-Concept Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/33260632501777-Proof-of-Concept-Rules-for-Audit-Competitions )

**Insight reports can be submitted**. 
Read our [Insight validity rules](https://immunefisupport.zendesk.com/hc/en-us/articles/34179768760337-Insight-Severity-Level )

IOP | CircuitDAO

Evaluating

Evaluating