InceptionLRT Smart Contracts: Program Info

Previous Audit Reports

You can find InceptionLRT previos reports here: https://docs.inceptionlrt.com/security/audit-reports

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Important: If an attacker can block the contract, but we can resolve the issue by upgrading it, we do not classify this as a permanent freeze. Therefore, we consider it to have a low impact.

• Any governance voting result manipulation- Critical Impact
• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield- Critical Impact
• Permanent freezing of funds- Critical Impact
• Miner-extractable value (MEV)- Critical Impact
• Protocol insolvency- Critical Impact
• Theft of unclaimed yield- High Impact
• Theft of unclaimed royalties- High Impact
• Permanent freezing of unclaimed yield- High Impact
• Permanent freezing of unclaimed royalties- High Impact
• Temporary freezing of funds for at least 30 days- High Impact
• Block stuffing for profit- Medium Impact
• Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)- Medium Impact
• Theft of gas- Medium Impact
• Unbounded gas consumption- Medium Impact
• Smart contract fails to deliver promised returns, but doesn’t lose value- Low Impact

Out of Scope & Rules

The maximum allowable payout for the bug discovery is capped at 5% of the potential loss.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

• Incorrect data supplied by third party oracles
• Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Centralization risks

The following activities are prohibited by this bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty