Kiln V2 Bounty
Bounty Range
$500,000 - $500,000
external program
/opportunities/leaderboard[/welcome](Discover Cantina)
[/login](Log in)[/signup](Sign up)
@kilnfi Live
https://x.com/Kiln_financehttps://github.com/kilnfihttps://www.kiln.fi/
Total reward
$500,000
No deposit required
Findings submitted
54
Start date
9 Sep 2024
Please sign in as a researcher to join the bounty.
[/login](Log in)
Kiln On-Chain (v2) enables non-custodial platforms to propose an ETH staking offer where users can stake any amount of ETH on operator pools while remaining the only one able to access their staked assets.
The goal of these Ethereum Smart Contracts is to enable:
For more information about Kiln On-Chain, please visit https://www.kiln.fi/kiln-on-chain
Smart Contract | Link | Nexus | https://etherscan.io/address/0x8a113da63f02811e63c1e38ef615df94df5d9e70 | Factory (Coinbase Cloud) | https://etherscan.io/address/0x2d5e65ff87d986d18ac224e725dc654bec3a04cd | Pool (Coinbase Cloud Pool) | https://etherscan.io/address/0x8eea6cc08d824b20efb3bf7c248de694cb1f75f4 | Oracle Aggregator (Coinbase Cloud Pool) | https://etherscan.io/address/0x4e6a0740aa4c89c7e36c430afe3dd3bec68b6aec | Pool (Coinbase Cloud Pool) | https://etherscan.io/address/0xd54ede626441ae514b15743d6a78a74c664b30a2 | Oracle Aggregator (Coinbase Cloud Pool) | https://etherscan.io/address/0x99a6d933bd22040136b7ccd5dbc3acdf2c103be6 | Factory (Kiln) | https://etherscan.io/address/0xc63d9f0040d35f328274312fc8771a986fc4ba86 | Pool (Kiln Pool) | https://etherscan.io/address/0x00a0be1bbc0c99898df7e6524bf16e893c1e3bb9 | Oracle Aggregator (Kiln Pool) | https://etherscan.io/address/0xd9f56e8a1b159b1482ec3bb6ce742fa5ce084f4c | factoryHatcher | https://etherscan.io/address/0xa748ae65ba11606492a9c57effa0d4b7be551ec2 | treasuryHatcher | https://etherscan.io/address/0x48005e62373277fbbe5584b351830b1b2ec1e3fd | poolHatcher | https://etherscan.io/address/0x1d6103243d0507a9d1314bac09379bf57a5cf155 | withdrawalRecipientHatcher | https://etherscan.io/address/0x066b6c3fca9034395068eb9d442ee5041eac33dc | execLayerRecipientHatcher | https://etherscan.io/address/0xdac8cf86ca42185ebce7ed2dbec9bc2be1734ffc | coverageRecipientHatcher | https://etherscan.io/address/0x24d6e12fa25b7f8fc6b4bba0ea77fc643d7210d3 | oracleAggregatorHatcher | https://etherscan.io/address/0xc2c48fbfec0e61683133aaff32c9c2e98fd17788 | exitQueueHatcher | https://etherscan.io/address/0x24a1dfebaec4e501c2152a5e4a434b236fce3d3b | ONTO Wallet Staked ETH (owsETH) | https://etherscan.io/address/0x0a3d5e898fa7e7d593a940486095c156c01a0b0c | Staking Rewards Partial ETH (srpETH) | https://etherscan.io/address/0x18099b65842cada4d87075920986559d9216a5bf | On-Chain Staked Ethereum (ocsETH) | https://etherscan.io/address/0x2401c39d7ba9e283668a53fcc7b8f5fd9e716fdf | CDP Staked ETH (CDPstakedETH) | https://etherscan.io/address/0x2e3956e1ee8b44ab826556770f69e3b9ca04a2a7 | Coinbase Wallet Staked ETH (cbwsETH) | https://etherscan.io/address/0x30a4aa1d14d44f0f5bfe887447ab6facc94a549f | CoolWallet Staked ETH (cwstETH) | https://etherscan.io/address/0x42ecf9bde9078d659663da66b97c4823f762005e | Crypto.com Defi Wallet ETH (cdwETH) | https://etherscan.io/address/0x437636e4b984eae19045626aa269a89f906cf96c | Walletverse Staked ETH (wvETH) | https://etherscan.io/address/0x594db36d6f3e747f2c7675659f712bf4d72a9f97 | Giddy Wallet Staked ETH (GiddyETH) | https://etherscan.io/address/0x5b1c9ee05794e9667806f1bd1c6ae6d196498183 | Pooled Staked ETH (psETH) | https://etherscan.io/address/0x5db5235b5c7e247488784986e58019fffd98fda4 | Bitnovo Staked ETH (bnETH) | https://etherscan.io/address/0x61ac42269d0035cd86c52b6c5bb299daa73c7135 | CDP Staked ETH (CDPstakedETH) | https://etherscan.io/address/0x7d4b92522df1c7d211cbab49148d9d260b5a5e41 | Dakota Kiln Staked ETH (dkETH) | https://etherscan.io/address/0x9995f241c6a0d5b712281dfd3bd0e0289a5f2a98 | MEW_Coinbase Staked ETH (MEWcbETH) | https://etherscan.io/address/0xba1613cf1ff0d7307315f1d98465e27877ad3f02 | Veno Kiln staked ETH (VenoKilnETH) | https://etherscan.io/address/0xe5faa3fcc7729c3ac7b4571207bb5978e5c33e81 |
Documentation for the assets provided in the table can be found at
Severity level | Impact: High | Impact: Medium | Impact: Low | Likelihood:high | Critical | High | Medium | Likelihood:medium | High | Medium | - | Likelihood:low | Medium | - | - |
Critical:
High:
Medium:
A PoC is required for the following severity levels:
Smart Contract:
Critical
High
Medium
Severity | Reward Amount | Critical | $500,000 | High | $50,000 | Medium | $20,000 |
Critical: Upto 500,000, Minumum payout 100,000 Rewards will be further capped at 10% of direct funds at risk based on the valid POC provided
High: Upto 50,000, Minimum payout 20,000 Rewards will be further capped at 100% of direct funds at risk based on the valid POC provided. In case of a temporary freeze of funds, reward is proportional to the amount of funds locked and increases as the freeze duration increases up until the maximum cap of the High severity levels.
Medium: Upto 20,000, Minimum payout $5,000 Rewards will be further capped at 100% of direct funds at risk based on the valid POC provided.
The bug bounty will have a hard cap of $1,000,000. In the case of multiple bug findings are submitted that exceed this amount, the rewards will be distributed on a first come first served basis.
These impacts are out of scope for this bug bounty program. General:
Consequences resulting from exploits the reporter has already carried out, which lead to damage.
Issues caused by attacks that require access to leaked keys or credentials.
Problems arising from attacks that need access to privileged roles (e.g., governance or strategist), except when the contracts are explicitly designed to prevent privileged access to functions that enable the attack.
Issues relying on attacks triggered by the depegging of an external stablecoin, unless the attacker causes the depegging due to a bug in the code.
References to secrets, access tokens, API keys, private keys, etc., that are not being used in production. Smart Contracts:
Issues arising from incorrect data provided by third-party oracles, with the exception of oracle manipulation or flash loan attacks.
Attacks that rely on basic economic or governance vulnerabilities, such as a 51% attack.
Problems related to insufficient liquidity.
Issues stemming from Sybil attacks.
Concerns involving risks of centralization.
Suggestions for best practices. Roles:
Admin, proxy admin, hatcher admin, treasury, oracles and other admin roles are trusted to behave properly and in the best interest of the users. They should not be considered as malicious. Submission citing malicious behaviour of these roles will be considered invalid.
Known issues listed and acknowledged below are not eligible for any reward through the bug bounty program.
Researchers who submit valid vulnerability reports agree to adhere to the following responsible disclosure process:
Security researchers who fall under any of the following are ineligible for a reward
The following information is required for payments:
If the claim comes from an individual:
The first names, surnames, date and place of birth of the person concerned
A Valid ID
If the claim comes from a business:
Legal form, name, registration number and address of the registered office
Valid certificate of incorporation
List of shareholders/directors
Live testing on public chains, including public mainnet deployments and public testnet deployments.
We recommend testing on local forks, for example using foundry.
Public disclosure of bugs without the consent of the protocol team.
Any denial of service attacks that are executed against project assets
Automated testing of services that results in a denial of service
Conflict of Interest: any employee or contractor working with Project Entity cannot participate in the Bug Bounty.
Attempting phishing or other social engineering attacks against our employees and/or customers