White-hat
web3 security.

Pay Per Vulnerability

With our pay-per-vulnerability model, you get transparent, cost-effective security assessments.

Why Choose Pay-Per-Vulnerability?

• Cost-Effective Security: You only pay for the vulnerabilities we discover and report so you receive maximum value from your investment, paying only for actionable security insights.

• Transparency and Trust: Our process is fully transparent, providing you with detailed reports that outline each vulnerability’s severity, potential impact on your smart contracts or blockchain systems, and recommended mitigation steps.

How We Classify Vulnerabilities

Our classification process considers several factors, including:

• Impact on Assets: Whether the vulnerability could lead to the theft, loss, or freezing of assets.

• Effect on Protocol Operations: How the issue could disrupt or degrade the functionality of the protocol.

• Likelihood of Exploitation: The probability that the vulnerability could be exploited, based on the complexity and required conditions.

• Compliance with Standards: Whether the issue causes non-compliance with established blockchain applications standards or practices.

High Severity

High-severity vulnerabilities are critical issues that can lead to significant harm to your protocol. These include, but are not limited to:

• Asset Theft: Vulnerabilities that allow unauthorized access or transfer of funds or tokens. For example, flaws in minting or transfer processes, reward distribution, trading, etc...

• Protocol Harm: Issues that disrupt the core functionality of the protocol, such as broken access controls that allow an attacker to take over the entire system.

• Denial of Service (DoS) Attacks: Vulnerabilities that could be exploited to make the protocol or key functions unavailable to users.

• Frozen Assets: Bugs that may cause user or protocol assets to be locked in a contract.

Medium Severity

Medium-severity vulnerabilities are issues that, while not immediately catastrophic, could still result in significant problems if left unaddressed. These issues might impact the functionality or availability of the protocol, potentially leading to moderate financial losses or operational disruptions. Examples include:

• Potential Asset Drainage: Risks that allow certain privileged roles to misuse their power, leading to unintended asset drainage or other harmful actions.

• Insufficient Access Control: Weaknesses in the implementation of roles and permissions that could allow unauthorized access or actions within the protocol.

• Inadequate Pausable Functionality: Absence of mechanisms to pause operations during emergencies, increasing the risk of unmitigated damage in the event of an attack.

• External Dependencies: Reliance on unaudited external libraries or systems, which could introduce vulnerabilities outside of the immediate control of the protocol developers.

• Uninitialized Variables or Functions: Potential risks arising from uninitialized variables or functions that could behave unpredictably under certain conditions.

Low & Informational Severity

Low-severity vulnerabilities are minor issues that have little impact on the protocol's security or functionality, but it would still be recommended to fix them before deployment. These might include:

• Gas Optimizations: Opportunities to improve the efficiency of the code, potentially reducing transaction costs for users by optimizing gas consumption.

• Lack of Test Coverage: Insufficient testing of critical functions, which could lead to overlooked issues or bugs during deployment or operation.

• Code Clarity and Maintainability: Minor issues such as inconsistent naming conventions, hardcoded values instead of constants, unused imports, or lack of inline comments, which can make the code harder to read and maintain.

• Non-Adherence to Best Practices: Issues like failing to follow the Checks-Effects-Interactions (CEI) pattern, which can expose the protocol to reentrancy attacks.

• Problematic Code Patterns: Code flow that doesn't pose an immediate risk but may introduce vulnerabilities on future upgrades.