Resonate Helper (unable to be verified, github link included below)

All smart contracts of Resonate can be found at [https://github.com/Revest-Finance](https://github.com/Revest-Finance). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

If any Critical or High severity impact can be caused to any other asset managed by Resonate that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project.

Resonate is the DeFi Yield futures protocol. Resonate splits apart the interest and principal components of a yield-bearing position. Those who hold tokens which may be deposited into yield-bearing systems can receive an instant, upfront payment on the present value of that future yield, in exchange for locking their tokens. An ideal solution for traders who want to receive guaranteed and consistent yield farming rewards for staking tokens or providing liquidity.

Theft of user funds in O(1) transactional complexity, including the theft of user funds from multiple pools within the same transaction

Permanent freezing of user funds

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames)

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc.

Changing the NFT metadata

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

Injection of malicious HTML or XSS through NFT metadata

Theft of user funds in O(n) transactional complexity, including the theft of user funds from multiple pools requiring multiple transactions

Temporary freezing of user funds for periods greater than one hour with no escape-hatch available during that period

Price manipulation via oracle-based attacks that results in theft of value, excluding provider-based attacks such as Chainlink

Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc.

Takedown of website for periods greater than four hours

Temporary freezing of user funds for periods less than one hour but spanning multiple blocks

Griefing and/or gas theft

Admin-based attacks that allow for theft of user-value

Price manipulation via oracle-based attacks that results in loss of value, excluding provider-based attacks such as Chainlink

Unintentional release of funds ahead of time

Smart contract fails to deliver promised returns without losing value

Price manipulation via oracle-based attacks that do not result in any loss of value, excluding provider-based attacks such as Chainlink

MEV-based slippage attacks (sandwich bots)

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All Critical/High/Medium severity bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Rewards for critical smart contract vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 40 000__. 

Critical website and application bug reports will be rewarded with __USD 30 000__ only if the impact leads to a direct loss in funds. All other impacts that would be classified as Critical would be rewarded no more than __USD 15 000__.

Known issues highlighted in the following audit report are considered out of scope: 
  - [Zellic Audit Part 1](https://www.resonate.finance/audits/Zellic-Part-I.pdf)
  - [Zellic Audit Part 2](https://www.resonate.finance/audits/Zellic-Part-II.pdf)
  - [BlockSec Audit](https://www.resonate.finance/audits/BlockSec-Audit.pdf)
  - [BlockSec Oracle Audit](https://www.resonate.finance/audits/BlockSec-Oracle-Audit.pdf)
  - [Bug Bounty Report by GalloDaSballo](https://docs.google.com/document/d/1NJm2d7JK5a8Cu-TGNip8AQwiVtNqcdd818xyUHkRnCM/edit)

Payouts are handled by the __Resonate__ team directly and are denominated in USD. However, payouts are done in __USDC__ or __RVST__, at the discretion of the team.

Resonate

Resources & Documentation