gitcoinbot
commented
2 years ago Issue Status: 1. Open 2. Started 3. Submitted 4. Done
Work has been started.
These users each claimed they can complete the work by 264 years, 6 months from now. Please review their action plans below:
1) datoga has started work.
I will work with some security tools, pentesting the apps and system to find security issues.
Learn more on the Gitcoin Issue Details page.
Bounty Table
Please use this structured bounty table for general guidance. All final decisions are at the discretion of Alluo DAO and the community.
This issue is specifically for the Medium Tier
If you would like to work on a tier that is higher please submit work to the relevant issue. Once submitted, work will be reviewed and at the discretion of the Alluo DAO following the OWASP model and then assigned to the correct Severity Level.
Response Targets
Alluo will make a best effort to meet the following SLAs for Contributors participating in our program:
Type of Response SLA in business days:
Time to Resolution depends on severity and complexity
We’ll try to keep you informed about our progress throughout the process.
Information & Resources
The Alluo protocol is a cross-chain liquidity management protocol that aims to acquire its liquidity via bringing no-coiners on-chain via its Neo-Bank like, non-custodial, backend free (and soon open sourced) mobile apps (andoird & iOS)
The features and improvements that the Core-Contributors team is working on are available on our public roadmap.
More documentation about the protocol and how it is working are a work in progress.
If you have any questions, feel free to reach out on Discord
Scope
All public assets, smart contracts and others that are public in the Alluo's Github repo are part of the scope.
Installation & Setup
We have guides available for how to get a deploy all the code locally in each separate repository. Generally, the Core-Contributor use Hardhat as a framework. See each repo for step-by-step walk-throughs.
Feel free to reach out to our Discord for help.
Program Rules
Email reports to bounty@alluo.io
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) the security impact of the bug. The following issues are considered out of scope:
Mentions of secrets, access tokens, private keys, etc. in Github, will be considered out of scope without proof that they are in use in production
alluo.com and alluo.finance
any subdomain of *.alluo.com
Intercom add-on on any asset (the in-browser chat application)
SGX-related issues or vulnerabilities
Issues/bugs/vulnerabilities specific to the given Ethereum client (Geth or Parity)
OS-related vulnerabilities
Clickjacking on pages with no sensitive actions.
Unauthenticated/logout/login CSRF.
Attacks requiring MITM or physical access to a user's device.
Previously known vulnerable libraries without a working Proof of Concept.
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
Missing best practices in SSL/TLS configuration.
Email or DNS configurations
Site or domain configuration
Any activity that could lead to the disruption of our service (DoS; please set up POCs on a private chain).
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Alluo and our community safe!