
BlockDev Sp. Z o.o
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
We are temporarily pausing all submissions and will have more information in the coming weeks.
The bug bounty program from the Maker Protocol currently contains two separate scopes, which share the same rules with a few exceptions as noted below. The scopes are:
The program may be expanded in the future to include more asset types such as frontends and apps.
We generally base our rewards on an OWASP Risk Rating Methodology score, factoring in both impact and likelihood. One exception to this is described in the Smart Contracts section.
A bug report may qualify for a reward only when:
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
Vulnerabilities contingent on any of the following activities do not qualify for a reward in the bug bounty program:
Please allow 5 business days for our reply. We may follow up with additional questions regarding how to reproduce the bug, and to qualify for a reward the investigator must respond to these in a timely manner.
This bug bounty program may be canceled or revised at any time. We pledge not to initiate legal action against investigators for security research conducted within the policies described in this document. If in doubt about the scope or conditions of the bug bounty program, please send your question to [email protected]
Maker team, their close family members, any other affiliated persons, as well as anyone who belonged to the aforementioned categories at any time during the past 6 months, are ineligible to participate in this program.
Thank you for helping keep Maker safe!
The smart contracts bug bounty program will develop in iterations:
The program is planned to be a long-running program that will continue indefinitely.
The scope is a selection of the core smart contracts of MCD as deployed on the Ethereum Kovan testnet, while more contracts will be added as needed.
The minimum amounts will also increase in future iterations of the bug bounty program.
Like the rest of the program, the smart contracts program generally uses the OWASP risk rating methodology for classifying bugs. One exception pertains to Critical bugs which must meet the following requirements:
Note: All Smart Contract bugs must include a PoC implementation with reproducible steps. This can be the form of a Solidity or JavaScript test or a list of actions that clearly shows how the bug occurs. We recommend using Dapp tools for testing.
At this time, rewards will be paid out for vulnerabilities discovered in our core smart contracts for Multi-Collateral Dai as listed below.
Exploits may be grouped as following:
Only exploits within groups 1-3 are currently eligible for rewards in this bug bounty program.
The following smart contracts are included in the bug bounty program. There may be redeployments of the contracts during the duration of the bug bounty program. Please see the section below for more information on the current release eligible for bug bounties.
Core System Contracts
MCD_VAT) - Core CDP EngineMCD_SPOT) - Price feed updaterMCD_JUG) - Stability fee accumulatorMCD_POT) - Dai SavingsMCD_CAT) - English Auction LiquidatorMCD_DOG) - Dutch Auction LiquidatorMCD_END) - Global Settlement ModuleMCD_FLAP) - Surplus AuctionMCD_FLIP) - English Collateral AuctionMCD_CLIP) - Dutch Collateral AuctionMCD_FLOP) - Debt AuctionMCD_VOW)- Dai SettlementDai
MCD_DAI) - Dai Token (note in a previous version of the bug bounty program this was DSToken. Currently it is dss/Dai.sol)MCD_JOIN_DAI) - Dai Token AdapterCollateral
MCD_ETH) - ETH Token WrapperInstant Access Modules
OSM_MOM) - allows oracle price updates to be halted without a governance delayFLIPPER_MOM) - allows liquidations to be enabled and disabled without a governance delay for collaterals using the English auction systemCLIPPER_MOM) - allows liquidations to be enabled and disabled without a governance delay for collaterals using the Dutch auction system; also allows permissionless disabling of liquidations for such collaterals if the Oracle module indicates that the price will fall by more than a specified per-collateral percentageMCD_IAM_AUTO_LINE) - allows the debt ceilings of configured collaterals to be raised and lowered permissionlessly in a constrained fashionOracles
seth call $PIP_ETH 'src()(address)') Medianizer for OraclesPIP_ETH, PIP_BAT, PIP_WBTC, PIP_ZRX, PIP_KNC, PIP_MANA, PIP_USDT, PIP_COMP, PIP_LRC, PIP_LINK, PIP_BAL, PIP_UNI, PIP_RENBTC, PIP_AAVE) Oracle Security ModulePIP_UNIV2DAIETH, PIP_UNIV2WBTCETH, PIP_UNIV2USDCETH, PIP_UNIV2DAIUSDC, PIP_UNIV2ETHUSDT, PIP_UNIV2LINKETH, PIP_UNIV2UNIETH, PIP_UNIV2WBTCDAI, PIP_UNIV2AAVEETH, PIP_UNIV2DAIUSDT) Uniswap V2 LP Token Oracle Security ModuleGovernance
The smart contracts included for "governance" have special limitations on the types of bugs that are currently considered in scope. For instance, it is a known design aspect of governance that governance has "root" access to the MCD system and with this permission is able to manipulate system parameters in such a way that it could take actions that would qualify under this program scope. We have recently added the Governance Security Module (see pause scope below) to provide a delay in governance actions and additional protection against malicious governance proposals. Generic "Governance could be malicious" reports are not in scope.
However, bugs in the DS-Chief contract that result in the voting with, locking, or theft of MKR tokens that are not owned by the attacker are considered in scope. A bug that shows an attacker locking, voting with, or stealing another user's MKR through a bug in the Chief would be considered critical.
Additionally, bugs in the Pause or Pause Proxy contracts or MCD system permissions that allow a Governance proposal to be enacted without waiting for the pause would be considered in scope. Specifically excluded from this scope would be an attack that relies on clogging the Ethereum network, colluding with miners, or Governance not noticing or being overwhelmed by malicious proposals long enough for the delay to pass. A bug that allows governance to act instantaneously through the pause contract or to directly affect some permissionned part of the MCD system is in scope unless done via an Instant Access Module (IAM). IAMs are smart contracts with permissions that permit bypassing of the governance delay for specific actions, which are either deemed to be safe, or to be necessary as emergency defenses. Any behavior of an instant access module that violates the intent of that module is still a bug.
Attacks Leveraging Other DeFi Protocols
Attacks in the DeFi space sometimes combine multiple protocols (e.g. utilizing flash loans from a margin protocol or manipulating the spot prices on a DEX). PoCs or descriptions of bug exploits may utilize such mechanisms, either to make an attack more severe than it would be in isolation, or to achieve an attack that would otherwise be impossible or infeasible. However, they will only be considered in-scope so long as:
As-needed deployments of the latest versions of the smart contracts to the Kovan testnet and mainnet will continue. New deployments of contracts in scope for the program will only contain bug fixes or minor enhancements, unless otherwise noted.
The bug bounty program will be applicable only to the releases specified in this policy. Submissions should indicate to which release they relate.
The only current release eligible for vulnerability reports is the active mainnet release. Only vulnerabilities found in this deployment can currently be submitted for a reward.
Contract details for all releases are available from changelog.makerdao.com
MCD 101 Guide A comprehensive overview of the smart contracts within MCD.
Official Documentation The full documentation of the Maker protocol, including smart contracts.
Source Code The MCD core contracts and some additional documentation can be found here:
If reading the codebase for the first time, we recommend overlaying our annotations for easier comprehension:
Deployment Scripts:
Seth Ethereum command-line tool used by our deploy scripts:
MCD CLI Command line-tool for interacting with MCD.
Faucet
A faucet is available to facilitate obtaining MKR and Collateral tokens on testnet. See the changelog to get the faucet address for the relevant deployment (FAUCET).
To claim tokens use the following seth command:
seth send $FAUCET ‘gimme()’
This will only work once per address.
Like the rest of the bug bounty program, the infrastructure program will evaluate bug reports based on the OWASP Risk Rating methodology. However, only Critical bugs are currently in scope.
The scope of our program focuses on exploiting specific externally facing Maker team infrastructure. This program covers security vulnerabilities discovered within the Maker public infrastructure including select websites and DNS configurations.
Systems in scope with this program are listed below. We expect to include more domains in the future.