TrueFi Lending Marketplace V1 Smart Contract Bug Bounty #6
Description
About TrueFi Lending Marketplace
TrueFi is an uncollateralized lending platform on Ethereum with almost $1B TVL and over $1B loans originated. We are launching a completely new version of the protocol, completely disconnected from the currently deployed contracts.
The initial iteration of this new version will be called our Lending Marketplace. This project has not yet officially launched. However, we have already deployed contracts and seeded them with a small amount of real funds for testing. We have also injected bugs to the current deployment in order to benchmark our internal red team, external auditors, and this bug bounty program.
Program Rules
- Public disclosure of a vulnerability before mitigation would make it ineligible for reward. Please report vulnerabilities to security@trusttoken.com and mention this bounty program.
- Social engineering attacks (e.g. phishing) are ineligible.
- Only Solidity smart contract code is currently eligible. If you disclose a web vulnerability, we may decide to reward you at our discretion.
- All disclosed vulnerabilities must include a POC implementation with reproducible steps. This can be Solidity code, a Typescript test, or a list of actions that clearly shows how the bug occurs. If the report is not detailed enough to reproduce the issue, then the vulnerability is ineligible.
- Injected bugs are eligible for the bug bounty program.
- Our employees and contracted external auditors are ineligible for this program.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to prove impact.
- When duplicates occur, we only reward the first report that was received. The first report rule also applies to any findings from our internal red team or external auditors.
- Multiple vulnerabilities caused by one underlying issue will be rewarded one bounty.
- The amounts below are our reward payouts based on severity. We aim to be fair; all reward amounts are at our discretion.
- Terms and conditions of the bug bounty process may vary over time.
Rewards
Our rewards are based on the severity of a vulnerability. TrustToken uses CVSS 3.0 (Common Vulnerability Scoring Standard) and the total percentage of potential capital loss to calculate severity. Please note, however, that reward decisions are up to the discretion of TrustToken and reward amounts may be adjusted during the program.
| Severity | Payout |
|---|---|
| Low | $1,250 |
| Medium | $2,500 |
| High | $5,000 |
| Critical | $10,000 |
Scope
The following contracts have been deployed to Ethereum mainnet and seeded with a small test amount of funds. They are in scope for this bug bounty.
| Contract | Address |
|---|---|
| BorrowerSignatureVerifier | 0x285Fe8Cb345d2B05b497d9C8DbB9601A8243d759 |
| Bounty ManagedPortfolio proxy | 0x73663Ac72988138f97C7A3fde6AbC638BcAd1E55 |
| BulletLoans | 0x8ddf7021fEA12A277F75414a1BAC32F1586cB5E6 |
| BulletLoans proxy | 0xd886ba98DdA7D337cC5EE1fd060CfC8D0D2368f3 |
| ManagedPortfolio | 0xf98b1BE69ca26D5b571c7359074A635a140308C1 |
| ManagedPortfolioFactory | 0x8470a53e59Db7b1f00376a7B752009F02e92073B |
| ManagedPortfolioFactory proxy | 0xd9919ddE053bcFd9e1A56d38C9704167999e3B54 |
| ProtocolConfig | 0x22651A862815E9240975ee5E0Ef8eDe577A7F335 |
| ProtocolConfig proxy | 0x12BD9b9a9Ec1a928202e2d78b125F9CCAA28E69b |
| SignatureOnlyLenderVerifier | 0xd69cABbe6700F329261A6Aa901f9Ee88f045976a |
Injected Bugs
In order to benchmark the relative effectiveness of our bug bounty program, internal security team, and external audits, our smart contracts engineering team has injected up to 10 possible bugs in our smart contract code. The following are precommitment hashes of descriptions for these possible bugs:
0xd53d78535e7aec1088b626017bd1d4bee173556af9d35934eaa61bb84b61d6e3 REPORTED
0x29719ac31658cec8c3b0ca909cf2bb86a8e0de712b3f1a31cfda2f42f30ed1ae REPORTED
0xb602c4cc8a2c5fa760e4e6b6bdd4db650745588d0b2869f994fc6763389559b2 REPORTED
0x9ad795b285d6c8041cc6cfa8039a2e920a5b282600f3743ea53df2b7f33a70b0
0x250b5cd71c784c13bda762272c9ab564ef4c782656d41f92d6c3fe9f4bc9491b
0xbc3be741c82c8bdbf18bccc387f5b17f7228cfcf5c5820243d3cacb6eae83665
0x74f98829afa7ad12977514761ace2227a66ed1e087baf6985b9c051401f7ce44
0x19883d22635f7115e785263cfddf0c3c89b00b19648137d28e1e0caa6e1ae8b6
0xe349f5441516f214f75fc743d02c95bcbb463e3a5b8221a9fd81a53e9620a6a0 REPORTED
0xc931bb243c38007be6410e1ce6dad9c837fd40ee6f59691f471fc126dd423246 REPORTED
After conclusion of the bounty and internal/external audits, we plan to reveal and fix these possible injected bugs.
UPDATE (2022-02-18): A report of our injected bugs can be found in our audits repo.