Smart-Contract Bug Bounty

[Kisgus]

This is a ✨ Cryptoxmas.xyz bounty✨

Every bounty DAI paid out will be matched as a donation to this Venezuelan Giveth Campaign

Scope

Below smart contracts are within scope of the bug bounty:

Contracts within scope

-NFT.sol
-CryptoxmasEscrow.sol

Contracts not within scope

-GivethBridge.sol

Payout

Minor discovered bugs, making cryptoxmas behave in an unexpected harmful way, without putting any funds at risk, will be rewarded with 50 DAI.

Critical vulnerability bugs allowing 3rd parties to steal or lock up funds will be rewarded with 200 DAI.

Responsible Disclosure

Make sure that you do not share your submission public until we have confirmed it to you, or else you will be disqualified. Issues will be credited on a first come — first serve basis. Issues already known to us or issues already submitted by another user will not be eligible for rewards.
Issues can be submitted anonymously.

Submit an empty "submission" via Gitcoin and send your "submission" to hi@volca.tech

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

This issue now has a funding of 300.0 DAI (300.0 USD @ $1.0/DAI) attached to it as part of the Gitcoin fund.

• If you would like to work on this issue you can 'start work' on the Gitcoin Issue Details page.
• Want to chip in? Add your own contribution here.
• Questions? Checkout Gitcoin Help or the Gitcoin Slack
• $45,247.23 more funded OSS Work available on the Gitcoin Issue Explorer

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

Work has been started.

These users each claimed they can complete the work by 4 weeks, 1 day from now.
Please review their action plans below:

1) pumpkingwok has started work.

Hi there, i can start to look in it.thanks

Learn more on the Gitcoin Issue Details page.

[PumpkingWok]

Hi @Kisgus,
First of all thank you for posting this bug bounty. I have noticed that the imports format is not compatible with remix for instance, i think it has to use a framework like embark for importing the external contracts correctly with this format.
Thanks in advance

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

Work has been started.

These users each claimed they can complete the work by 3 years, 1 month ago.
Please review their action plans below:

1) mohoff has started work.

Looking at both contracts trying to find bugs
2) christopher-i has started work.

Hi there, I would like to tackle this problem. I have created multiple smart contracts and I can run 'NFT.sol'
and ' CryptoxmasEscrow.sol' through a rigirous test process in Mocha that I use to fish out bugs.

Learn more on the Gitcoin Issue Details page.

[mikhaildobs]

Hi @Kisgus,
First of all thank you for posting this bug bounty. I have noticed that the imports format is not compatible with remix for instance, i think it has to use a framework like embark for importing the external contracts correctly with this format.
Thanks in advance

Hey @PumpkingWok, please check building instructions here - https://github.com/VolcaTech/cryptoxmas.xyz/tree/master/cryptoxmas-contracts#building-contracts

[srisankethu]

Documentation: "... address transit address ..." is a mistake here

EDIT: Another one here

[srisankethu]

@Kisgus Should this be an internal function? This is a simple check which is used internally.

I don't find any vulnerability. Well written. I ran solhint and found many linting errors.

[mikhaildobs]

@srisankethu Thanks for auditing the code! canBuyGift is public, because it should be used on the front-end as an additional check if user is able to buy gift and that transaction can go through :)

Thanks for pointing out to solhint, will use it for the next projects! 👍

[srisankethu]

@Dobrokhvalov So should I "stop work" on gitcoin!?

I see it a view function too stopping its ability to modify the state. But canBuyGift is used in BuyGift. In what other cases(other than in BuyGift) can it be used? canBuyGift is basically just a check for BuyGift.

If canBuyGift should be public, then it does not have a test written.

[mohoff]

Hi, I submitted some findings 6 days ago via e-mail. Just seeing that you fixed these issues on the same day, @Dobrokhvalov . I haven't received any reply from you guys since my submission.

Any news?

[mikhaildobs]

Hey @mohoff , I agree with your findings, thanks for the contribution. @Kisgus should have answered you via email and handle the pay out.

[mohoff]

You're welcome! Thanks, @Kisgus hasn't reached out yet

[Kisgus]

Hey @mohoff sorry for the delay. Your submission was valid and you will get your bounty, which is funded by Gitcoin themselves. In order to be able to send you your part, you need go to https://gitcoin.co/ and press "Submit work", this will enable Gitcoin to pay out your bounty.

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

Work for 300.0 DAI (300.0 USD @ $1.0/DAI) has been submitted by:

1. @mohoff

@ceresstation please take a look at the submitted work:

• (Link Not Provided) by @mohoff

---

• Learn more on the Gitcoin Issue Details page
• Want to chip in? Add your own contribution here.
• Questions? Checkout Gitcoin Help or the Gitcoin Slack
• $44,045.44 more funded OSS Work available on the Gitcoin Issue Explorer