Skip to content

Commit 8be9e36

Browse files
rudy5348rudy5348
authored
Create SECURITY.md
1 parent cecad9f commit 8be9e36

File tree

1 file changed

+105
-0
lines changed

1 file changed

+105
-0
lines changed

‎SECURITY.md

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Raydium CLMM Bug Bounty Program
2+
3+
Raydium's full bug bounty program with ImmuneFi can be found at: https://immunefi.com/bounty/raydium/
4+
5+
## Rewards by Threat Level
6+
7+
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3. This is a simplified 5-level scale, focusing on the impact of the vulnerability reported.
8+
9+
### Smart Contracts
10+
11+
| Severity | Bounty |
12+
| -------- | ------------------------- |
13+
| Critical | USD 50,000 to USD 505,000 |
14+
| High | USD 40,000 |
15+
| Medium | USD 5,000 |
16+
17+
All bug reports must include a Proof of Concept (PoC) demonstrating how the vulnerability can be exploited to impact an asset-in-scope to be eligible for a reward. Critical and High severity bug reports should also include a suggestion for a fix. Explanations and statements are not accepted as PoC and code is required.
18+
19+
Rewards for critical smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 50,000.
20+
21+
Bugs in `raydium-sdk` and other code outside of the smart contract will be assessed on a case-by-case basis.
22+
23+
## Report Submission
24+
25+
Please email [email protected] with a detailed description of the attack vector. For high- and critical-severity reports, please include a proof of concept. We will reach back out within 24 hours with additional questions or next steps on the bug bounty.
26+
27+
## Payout Information
28+
29+
Payouts are handled by the Raydium team directly and are denominated in USD. Payouts can be done in RAY, SOL, or USDC.
30+
31+
## Out of Scope & Rules
32+
33+
The following vulnerabilities are excluded from the rewards for this bug bounty program:
34+
35+
- Attacks that the reporter has already exploited themselves, leading to damage
36+
- Attacks requiring access to leaked keys/credentials
37+
- Attacks requiring access to privileged addresses (governance, strategist)
38+
- Incorrect data supplied by third party oracles (not excluding oracle manipulation/flash loan attacks)
39+
- Basic economic governance attacks (e.g. 51% attack)
40+
- Lack of liquidity
41+
- Best practice critiques
42+
- Sybil attacks
43+
- Centralization risks
44+
- Any UI bugs
45+
- Bugs in the core Solana runtime (please submit these to [Solana's bug bounty program](https://github.com/solana-labs/solana/security/policy))
46+
- Vulnerabilities that require a validator to execute them
47+
- Vulnerabilities requiring access to privileged keys/credentials
48+
- MEV vectors the team is already aware of
49+
- The CLMM contract emits trading fee and farming yield tokens to LPs. If tokens from the vault or fees were drained by an attacker however, users would not be able to claim yield and transactions would fail. This is by design and not a vulnerability.
50+
51+
## Concentrated Liquidity Assets in Scope
52+
53+
| Target | Type |
54+
| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------ |
55+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/collect_fund_fee.rs | Smart Contract - collect_fund_fee |
56+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/collect_protocol_fee.rs | Smart Contract - collect_protocol_fee |
57+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/create_operation_account.rs | Smart Contract - create_operation_account |
58+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/mod.rs | Smart Contract - admin/mod |
59+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/transfer_reward_owner.rs | Smart Contract - transfer_reward_owner |
60+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/update_amm_config.rs | Smart Contract - update_amm_config |
61+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/update_operation_account.rs | Smart Contract - update_operation_account |
62+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/admin/update_pool_status.rs | Smart Contract - update_pool_status |
63+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/close_position.rs | Smart Contract - close_position |
64+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/collect_remaining_rewards.rs | Smart Contract - collect_remaining_rewards |
65+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/create_pool.rs | Smart Contract - create_pool |
66+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/decrease_liquidity.rs | Smart Contract - decrease_liquidity |
67+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/increase_liquidity.rs | Smart Contract - increase_liquidity |
68+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/initialize_reward.rs | Smart Contract - initialize_reward |
69+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/mod.rs | Smart Contract - instructions/mod |
70+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/open_position.rs | Smart Contract - open_position |
71+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/set_reward_params.rs | Smart Contract - set_reward_params |
72+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/swap.rs | Smart Contract - swap |
73+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/swap_router_base_in.rs | Smart Contract - swap_router_base_in |
74+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/instructions/update_reward_info.rs | Smart Contract - update_reward_info |
75+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/big_num.rs | Smart Contract - big_num |
76+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/fixed_point_64.rs | Smart Contract - fixed_point |
77+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/full_math.rs | Smart Contract - full_math |
78+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/liquidity_math.rs | Smart Contract - liquidity_math |
79+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/mod.rs | Smart Contract - libraries/mod |
80+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/sqrt_price_math.rs | Smart Contract - sqrt_price_math |
81+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/swap_math.rs | Smart Contract - swap_math |
82+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/tick_array_bit_map.rs | Smart Contract - tick_array_bit_map |
83+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/tick_math.rs | Smart Contract - tick_math |
84+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/libraries/unsafe_math.rs | Smart Contract - unsafe_math |
85+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/config.rs | Smart Contract - config |
86+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/mod.rs | Smart Contract - states/mod |
87+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/operation_account.rs | Smart Contract - operation_account |
88+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/oracle.rs | Smart Contract - oracle |
89+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/personal_position.rs | Smart Contract - personal_position |
90+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/pool.rs | Smart Contract - pool |
91+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/protocol_position.rs | Smart Contract - protocol_position |
92+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/states/tick_array.rs | Smart Contract - tick_array |
93+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/util/access_control.rs | Smart Contract - access_control |
94+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/util/mod.rs | Smart Contract - util/mod |
95+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/util/system.rs | Smart Contract - system |
96+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/util/token.rs | Smart Contract - token |
97+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/error.rs | Smart Contract - error |
98+
| https://github.com/raydium-io/raydium-clmm/blob/master/programs/amm/src/lib.rs | Smart Contract - lib |
99+
100+
## Additional Information
101+
102+
Documentation and instruction for PoC can be found here:
103+
https://github.com/raydium-io/raydium-docs/blob/master/dev-resources/raydium-clmm-dev-doc.pdf
104+
105+
A public testnet of Raydium's CLMM can be found at https://explorer.solana.com/address/proKtffCScMcwkFkPHFcuHawN7mWxRkhyh8PGxkTwYx However, note that testing on the public testnet is prohibited by the program rules. The public testnet is provided for reference only.

0 commit comments

Comments
 (0)