Acala Bug Bounties

Assets in Scope

Target	Type	Added on
	Blockchain/DLT - Main Network	11 February 2022
	Blockchain/DLT - Open Runtime Module Library	11 February 2022

Target

Type

Added on

Blockchain/DLT - Main Network

11 February 2022

Target

Type

Added on

Blockchain/DLT - Open Runtime Module Library

11 February 2022

Impacts in Scope

Critical	Transaction/consensus manipulation
Critical	Double-spending
Critical	Unauthorized token minting
Critical	Getting access to an identity that can lead to unauthorized access to system’s or user’s assets
Critical	Governance compromise
High	Blocking or modifying processes for governance or users from performing their tasks, generating not handled on-chain errors
Medium	Putting on-chain data into an unexpected state without interrupting the system or users from performing their tasks, e.g. generating redundant events, logs, etc.

Critical

Transaction/consensus manipulation

Critical

Double-spending

Critical

Unauthorized token minting

Critical

Getting access to an identity that can lead to unauthorized access to system’s or user’s assets

Critical

Governance compromise

High

Blocking or modifying processes for governance or users from performing their tasks, generating not handled on-chain errors

Medium

Putting on-chain data into an unexpected state without interrupting the system or users from performing their tasks, e.g. generating redundant events, logs, etc.

View rewards

Out of scope

Program's Out of Scope information

The following vulnerabilities are excluded from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)
DDOS attack
Denial of service attacks
Spamming
Any physical attacks against Karura property, or employees
Phishing or other social engineering attacks against our Karura’s employees

The following activities are prohibited by this bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty