Tinyman AMM v2.0 Protocol Bug Bounties

Assets in Scope

Target	Type	Added on
	Smart Contract - pool_template	28 November 2022
	Smart Contract - amm_clear_stat	28 November 2022
	Smart Contract - amm_approval	28 November 2022

Target

Type

Added on

Smart Contract - pool_template

28 November 2022

Target

Type

Added on

Smart Contract - amm_clear_stat

28 November 2022

Target

Type

Added on

Smart Contract - amm_approval

28 November 2022

Impacts in Scope

Critical	Direct theft of any user funds
Critical	Permanent freezing of user funds
Critical	Protocol insolvency
Critical	Modification/deletion of application
Critical	Taking signer authority of pool accounts
High	Theft of protocol fees
High	Permanent freezing of unclaimed protocol fees
High	Temporary freezing of user funds for at least 24 hours
High	Unauthorized updates to protocol parameters
Medium	Smart contract unable to operate due to lack of token funds
Medium	Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Medium	Making pool accounts pay unnecessary transaction fees

Critical

Direct theft of any user funds

Critical

Permanent freezing of user funds

Critical

Protocol insolvency

Critical

Modification/deletion of application

Critical

Taking signer authority of pool accounts

High

Theft of protocol fees

High

Permanent freezing of unclaimed protocol fees

High

Temporary freezing of user funds for at least 24 hours

High

Unauthorized updates to protocol parameters

Medium

Smart contract unable to operate due to lack of token funds

Medium

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Medium

Making pool accounts pay unnecessary transaction fees

View rewards

Out of scope

Program's Out of Scope information

The following vulnerabilities are excluded from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
Basic economic governance attacks (e.g. 51% attack)
Lack of liquidity
Best practice critiques
Sybil attacks
Centralization risks

The following activities are prohibited by this bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty