All smart contracts of Arcade.xyz can be found at [https://github.com/arcadexyz/arcade-protocol/tree/main/contracts](https://github.com/arcadexyz/arcade-protocol/tree/main/contracts) and [https://github.com/arcadexyz/dao-contracts/tree/main/src](https://github.com/arcadexyz/dao-contracts/tree/main/src). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Though only the proxy contract for AssetVault  is  listed as in-scope, current implementation and any further updates to the implementation contract are considered in scope. When reporting a bug, please make sure to select the proxy smart contract as the target. AssetVault is the only upgradeable contract in the protocol. 

If an impact can be caused to any other asset managed by Arcade.xyz that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project. This only applies to Critical and High impacts.

Arcade.xyz is the first of its kind Web3 platform to enable liquid lending markets for NFTs. At Arcade.xyz, we think all assets will eventually become digitized and that NFTs represent a 0 to 1 innovation in storing value and ownership attribution for unique digital assets.

Ability for an attacker to cause the entire protocol to freeze, including loans in which they are not a counterparty

Ability for an attacker to steal any asset held by the protocol, without limitation, including loans in which they are not a counterparty

Ability for an attacker to claim collateral for defaulted loans in which they are not a counterparty

Direct theft of any staking user funds, whether at-rest or in-motion

Permanent freezing of staked funds

With the attacker as a borrower, the ability to regain control of collateral without repaying your loan

With the attacker as a borrower, the ability to force your lender to issue loan funding without placing collateral in escrow

With the attacker as a borrower, the ability to prevent a lender from claiming collateral when a loan is defaulted

With the attacker as a lender, the ability to claim collateral before your loan’s due date

With the attacker as a lender, the ability to prevent borrower repayments to force a default

With the attacker as a lender, the ability to force a borrower to place collateral in escrow without issuing funding

With the attacker as either counterparty, the ability to force another party to enter a loan under terms they did not consent to either via signature, or the other party submitting a function call

Theft of unclaimed staking yield

Permanent freezing of unclaimed staking yield

Temporary freezing of staked funds

The ability of a user to withdraw their staked tokens before the end of the lock period

The ability to force the issuance of a bonus multiplier incompatible with the chosen lock period

The ability to force the issuance of voting power incompatible with the properties of a user’s stake

The ability to prevent another staker from claiming their rewards

The ability to prevent another staker from withdrawing their staked tokens

The ability to overdraw rewards

The ability to overdraw staking tokens

The alteration of a user's voting power

Ability for an attacker to gain governance voting power for stakes in which they are not a participant

Staking contract fails to deliver promised returns.

Ability to freeze the protocol from originating new loans, without affecting currently open loans or locking assets

Ability to drain protocol fees or block protocol fees

Ability to block protocol fees from being withdrawn by contract owners

Ability to bypass whitelisting requirements for loan collateral, payable currencies, and allowed verifiers

Ability to manipulate whitelists for loan collateral, payable currencies, and allowed verifiers without the protocol-defined permissions (whitelist manager role)

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) and theft of gas

Unbounded gas consumption

Ability to block the recoverERC20 functions in the staking contracts.

Any finding which impacts protocol logic without circumventing loan rules or stealing/freezing user funds

Staking contract fails to deliver promised rewards, but doesn't lose any tokens.

Any finding which impacts staking contract logic without circumventing staking rules or stealing/freezing user funds.

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All High and Critical Smart Contract bug reports require a PoC and a suggestion for a fix to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.

Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward o __USD 20 000__. 

All vulnerabilities marked in the [https://github.com/arcadexyz/arcade-protocol/tree/main/audits](https://github.com/arcadexyz/arcade-protocol/tree/main/audits) are not eligible for a reward.

Payouts are handled by the __Arcade.xyz__ team directly and are denominated in USD. However, payouts are done in __USDC__.

Arcade.xyz

Resources & Documentation