GNSMultiCollatDiamond (and all its facets)

All of the smart contracts of Gains Network can be found at [https://github.com/GainsNetwork](https://github.com/GainsNetwork) and [https://github.com/GainsNetwork/GNS-ethereum](https://github.com/GainsNetwork/GNS-ethereum). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

In case of discrepancy between [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/)I and Gains Network’s classification above, Gains Network classification will be followed. 

Our trading contracts use the diamond architecture. All facets of the diamond are considered in-scope for this bounty.

More generally, any active smart contract deployed by the Gains Network protocol containing or having the ability to impact significant Gains Network users funds (>$100k) is considered as in-scope. For example gDAI is listed above but we didn’t list every gToken (gETH, gUSDC, and any future gToken) for practical reasons.

For the same reasons, we also didn’t list every deprecated version of our previous NFTs (which can be redeemed for $GNS) to not clog up assets in scope, however if a vulnerability is found in these old contracts that can affect current Gains Network user funds, it will be considered in-scope.

In summary, if an impact can be caused to any other asset managed by Gains Network that isn’t on this table but for which the impact is in the Impacts in Scope section, you are encouraged to submit it for the consideration of the project.

Gains Network is building the decentralized finance ecosystem of the future. Their first product, gTrade is a capital-efficient decentralized leveraged trading platform on Polygon and Arbitrum.

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Insolvency

Permanent freezing of user funds, other than unclaimed yield

Ability to execute system commands

Extract Sensitive data/files from the server such as /etc/passwd

Stealing User Cookies

Signing transactions for other users

Redirection of user deposits and withdrawals

Wallet interaction modification resulting in financial loss

Subdomain takeover resulting in financial loss (applicable for subdomains with addresses published)

Direct theft of user funds

Tampering with transactions submitted to the user’s wallet

Submitting malicious transactions to an already-connected wallet

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Spoofing content on the target application (Persistent)

Users Confidential information disclosure such as Email

Subdomain Takeover without financial loss (applicable for subdomains with no addresses published)

Privilege escalation to access unauthorized functionalities

Taking down the application/website

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Temporary freezing of funds, including unclaimed yield

Changing details of other users without direct financial impact (CSRF)

Third-Party API keys leakage that demonstrates loss of funds or modification on the website

Redirecting users to malicious websites (Open Redirect)

Smart contract unable to operate due to lack of funds

Smart contract fails to deliver promised returns, but doesn’t lose value

Block stuffing for profit

Theft of Gas

Unbounded gas consumption

Changing details of other users (including modifying browser local storage) without already-connected wallet interaction & with significant user interaction, such as: framing leading to modifying the backend/browser state(must demonstrate impact with PoC)

Taking over broken or expired outgoing links, such as: Social media handles, etc.

Temporarily disabling user to access target site, such as: Locking up the victim from login, Cookie bombing, etc.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). This is a simplified 4-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All web/app bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of USD 50 000.

Vulnerabilities concerning temporary freezing of funds, where the impact affects more than one user, the reward increases at a multiplier of 1.5 from the Medium Reward category for every additional 24h that the funds are temporarily frozen, up until a max cap of the High Reward category. This is because as the duration of the freezing lengthens, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature. 

Payouts are handled by the __Gains Network__ team directly and are denominated in USD. However, payouts are done in __GNS and DAI__, with the choice of the ratio at the discretion of the team.

__Primacy of Impact vs Primacy of Rules__

Gains Network adheres to the Primacy of Impact for the following impacts:

Smart Contract - Critical
Smart Contract - High
Smart Contract - Medium
Websites and Applications - Critical

All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms and conditions set within this program.
Learn more about report validity best practices here: [Best Practice - Primacy of Impact vs Primacy of Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/12340245635089-Best-Practices-Primacy-of-Impact?utm_source=immunefi).

Gains Network

Resources & Documentation