Exactly Bug Bounty

Exactly is a decentralized, non-custodial, and open-source protocol that provides an autonomous fixed and variable interest rate market, enabling users to frictionlessly exchange the time value of their assets and complete the DeFi credit market.

Built on top of the protocol, the Exa App is a self-custodial wallet and card. Each user gets a modular smart account (ERC-6900) with the Exa Plugin installed. The Exa Card pays from that account onchain, by debit, credit, or installments, using Exactly Protocol as the lending layer.

For more information, please visit exact.ly and exactly.app.

Severity Definitions

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered in scope, even if they affect an asset listed in scope.

Critical

• Any governance voting result manipulation
• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
• Permanent freezing of funds
• Miner-extractable value (MEV)
• Predictable or manipulable RNG that results in abuse of the principal
• Protocol insolvency

High

• Theft of unclaimed yield
• Theft of unclaimed royalties
• Permanent freezing of unclaimed yield
• Permanent freezing of unclaimed royalties
• Temporary freezing of funds for at least 4 hours
• Substantial generation of bad debt on the protocol

Critical rewards are capped at 10% of the economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the Exactly team.

In addition to the above definitions, we will also use the Cantina Bug Bounty Severity Classification Framework to determine severity.

Proof of Concept

All High and Critical reports require a runnable Proof of Concept (PoC) to be eligible for a reward. Explanations and statements are not accepted as a PoC; code is required.

Known Issues

Reports covering previously discovered bugs are not eligible for a reward. If a report covers a known issue (e.g., the use of a deprecated Chainlink API reported in EXA-36), it may be rejected together with proof that the issue was known.

Previous audits and known issues can be found in the Exactly audits documentation.

Prohibited Actions

• Any testing on mainnet or public testnet deployed code; all testing should be done on local forks of either public testnet or mainnet.
• Any testing with pricing oracles or third-party smart contracts.
• Attempting phishing or other social engineering attacks against Exactly employees and/or customers.
• Any testing with third-party systems and applications (e.g., browser extensions) as well as websites (e.g., SSO providers, advertising networks).
• Any denial of service attacks executed against project assets.
• Automated testing of services that generates significant amounts of traffic.
• Public disclosure of an unpatched vulnerability.
• All discussion about a submitted finding must happen on Cantina. Contacting the program client or its employees about it through any other channel may result in the finding being rejected with no reward and a ban from the Cantina platform.

Eligibility

KYC is required for this bug bounty program. Government identification, legal name, and country of residence will need to be supplied to receive a reward.

Other Terms

Rewards are denominated in USD and are handled by the Exactly team.