Autonolas

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist, community multisig)
• Attacks building on already identified attacks

Smart Contracts and Blockchain

• Incorrect data supplied by third party oracles
  • Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Centralization risks
• Attacks that attempt to disrupt the protocol's availability, such as flooding the system with an excessive number of non-useful components or non-useful components within agents, resulting in gas resource exhaustion. Additionally, attacks that attempt to cause gas resource exhaustion issues by making minimal donations to a large number of services with numerous components.
• All vulnerabilities that arise from misconfigured registration from users (e.g. component owners, agent owners, service owners, agents operators) or misuse of the registration logic (e.g. accidental locking of funds, loss of keys to control services, etc.).
• Vulnerabilities that arise or are built upon the fact that GuardCM implies a reduction of the community multisig functionalities as originally designed, such us self-calls within community multisig.
• The following are considered out of scope for “permanent freezing of funds” Critical Impact: when the freezing of funds is attributed to unintended use of the contracts: Component Registry, Agent Registry, Service Registry, Service Registry Token Utility, Registries Manager, Service Manager Token, Operator Whitelist, Gnosis Safe Multisig, Gnosis Safe Multisig Same Address, Service Registry L2, Service Manager.
• The following contract are not in scope for “Griefing” Medium Impact: Component Registry, Agent Registry, Service Registry, Service Registry Token Utility, Registries Manager, Service Manager Token, Operator Whitelist, Gnosis Safe Multisig, Gnosis Safe Multisig Same Address, Service Registry L2, Service Manager

The following activities are prohibited by this bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty