USDai

USDai is an $PYUSD-backed stablecoin. Staked USDai (sUSDai) is a yield-bearing vault token backed by USDai $PYUSD yield from PayPal's incentives and loans against GPUs.

Prohibited Actions

• No Unauthorized Testing on Production Environments:

Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setups.

• No Public Disclosure Without Consent:

Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.

• No Exploitation or Data Exfiltration:

Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service.

• No Conflict of Interest:

Individuals currently or formerly employed by USDai, or those who contributed to the development of the affected code, are ineligible to participate.

Disclosure Requirements

Please report vulnerabilities directly through the Spearbit/Cantina platform. Please include:

• A clear description of the vulnerability and its impact.
• Steps to reproduce the issue, including a proof of concept.
• Details on the conditions under which the issue occurs.
• Potential implications if the vulnerability were exploited.

Reports should be made as soon as possible—ideally within 24 hours of discovery.

Eligibility

To be eligible for a reward, you must:

• Be the first to report a previously unknown, non-public vulnerability within the defined scope.
• Provide sufficient information to reproduce and fix the vulnerability.
• Not have exploited the vulnerability in any malicious manner.
• Not have disclosed the vulnerability to third parties before receiving permission.
• Comply with all Program rules and applicable laws.

You must also be of legal age in your jurisdiction and not be a resident in a country under sanctions or restrictions, as required by applicable laws.

Scope

For USDai contract repo the following contracts at the commit: 5ef4905a9ca11ff751039fde037b351b12737f9d

• USDai.sol
• StakedUSDai.sol
• StakedUSDaiStorage.sol
• RedemptionLogic.sol
• UniswapV3SwapAdapter.sol
• ChainlinkPriceOracle.sol
• PositionManager.sol
• BasePositionManager.sol
• LoanRouterPositionManager.sol
• LoanRouterPositionManagerLogic.sol
• OAdapter.sol
• OToken.sol
• OUSDaiUtility.sol

For USDai loan router contract repo the following contracts at the commit: 59adf3e208c897b0f04059f186bc28f7f1e75e14

• LoanRouter.sol
• LoanTermsLogic.sol
• DepositTimelock.sol
• USDaiSwapAdapter.sol
• UniswapV3SwapAdapter.sol
• AmortizedInterestRateModel.sol
• SimpleInterestRateModel.sol
• BundleCollateralWrapper.sol

Out of Scope

• Refer to the previous security reports here: https://docs.usd.ai/technical-overview/audits
• ETH refund or bridging subsidy in OUSDaiUtility.sol
• Timing depositing (staking) of USDai based on redemption share price fluctuations
• Indeterministic redemption outcome due to timing of admin processing redemptions with respect to borrower repayments
• Overestimating or underestimating of optimistic share price due to borrower repayment timing
• Borrower interaction with StakedUSDai.sol except through LoanRouter.sol
• Any blacklisting inconsistency or blacklisting on non-source chain (non-Arbitrum chain)
• Missing admin fee withdrawal in LoanRouterPositionManager.sol
• Branches outside of branch in repo links provided above
• Frontend
• Incorrect data supplied by third party oracles
• Gas/code optimizations
• Self-griefing attacks
• Claiming of unsolicited airdrops
• Please refer to the default Out of Scope for more details.

Severity and Rewards

Vulnerabilities are classified using two factors: Impact and Likelihood. The combination of these factors determines the severity and guides the reward amount.

Risk Classification Matrix

Impact Definitions

• Critical: Vulnerabilities that can lead to severe loss of user funds, permanent system disruption, or widespread compromise.
• High: Vulnerabilities that cause notable financial loss or significantly harm user trust, but on a lesser scale than Critical.
• Medium: Vulnerabilities that lead to limited financial damage or moderate system impact.
• Low/Informational: Findings that pose minimal direct risk but reflect areas for improvement or best practices.

Likelihood Definitions

• High: Very easy to exploit or highly incentivized.
• Medium: Exploitation is possible under certain conditions.
• Low: Difficult to exploit or requires highly specific conditions.

Payout Guidelines

Core Smart Contract Code

Note: Actual reward amounts are determined at USDai's sole discretion. Factors influencing payout include quality of report, completeness, and the severity and exploitability of the vulnerability.

Other Terms

By submitting a report, you grant USDai the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of USDai. The terms, conditions, and scope of this Program may be revised at any time. All participants are responsible for reviewing the latest version before submitting a report.