infinifi-protocol

infinifi-protocol

@infinifi
LiveCantina-Triaged

Maximum reward

$100,000

Severity

Max. Reward

Critical

$100,000

High

$15,000

Deposit required

$50

Findings submitted

348

Start date

8 Jun 2025

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Core Smart Contract CodeWeb Interface / Application:CoreFarmsOraclesTokens

Severity

Min and Max Reward

Critical

Up to $100,000

High

Up to $15,000

More redefined core contracts group.

Name
Description
Asset
CORE

Access control and role registry for the protocol

0xF6…5490

TIMELOCK_SHORT

Short-duration timelock for governance actions

0x4B…7c32

TIMELOCK_LONG

Long-duration timelock for governance actions

0x3D…48a9

FARM_REGISTRY

Registry of all protocol farm allocations

0xF5…6119

MANUAL_REBALANCER_V2

Manual rebalancing tool for farm allocations

0x5f…2777

LOCKING_CONTROLLER

Manages iUSD locking and lock period logic

0x1d…7fF7

UNWINDING_MODULE

Handles early unwinding of locked positions

0x70…dFcc

ACCOUNTING

Tracks and reconciles protocol asset valuations

0x7A…42B3

YIELD_SHARING_PROXY

Active yield distribution contract (proxy)

0x90…AE3b

YIELD_SHARING_V3

Latest yield sharing implementation

0x0D…07E5

ALLOCATION_VOTING

Governance voting for farm allocation weights

0x49…F853

MINT_CONTROLLER

Controls iUSD minting parameters and flow

0x49…C256

REDEEM_CONTROLLER

Controls iUSD redemption parameters and flow

0xCb…7601

AFTER_MINT_HOOK

Hook executed after iUSD minting

0xa5…97a8

BEFORE_REDEEM_HOOK

Hook executed before iUSD redemption

0x4b…1395

GATEWAY_PROXY

Main user-facing entry point for protocol interactions (proxy)

0x3f…25b5

GATEWAY_IMPLEMENTATION_V3

Latest gateway implementation

0xb4…ffB6

GATEWAY_PROXY_ADMIN

Admin contract for gateway proxy upgrades

0x21…141c

UNSTAKE_AND_REDEEM_HELPER

Single-tx helper to unstake siUSD and redeem

0x4f…9dFE

EMERGENCY_WITHDRAWAL

Emergency withdrawal mechanism for protocol funds

0xa4…26e9

MINOR_ROLES_MANAGER

Manages assignment of minor protocol roles

0xa0…be9b

MATURED_FARM_CLEANER

Cleans up and settles matured/expired farm positions

0x60…fa56

ORACLE_FACTORY

Factory for deploying protocol oracle contracts

0xA2…Ed91

MIGRATION_CONTROLLER

Manages contract version migrations

0x5F…39F8

PL_SMOOTHER

Smooths protocol P&L reporting over time

0xC3…57A4

PL_SMOOTHER_HELPER

Helper contract for PL smoother calculations

0x21…10b8

RWA_RATE_MANAGER

Manages interest rates for RWA allocations

0x11…4189

Out of scope

Out-of-Scope Targets:

  • Contracts listed in addresses.1.json that are deployed by third parties, like ERC20_USDC, ROUTER_PENDLE, … InfiniFi’s deployer address is 0xdecaDAc8778D088A30eE811b8Cc4eE72cED9Bf22 and all our contracts are verified on Etherscan
  • api.infinifi.xyz
  • Issues described in previous audit reports (Spearbit, Certora, Cantina), reports are available on our documentation website.
  • Ongoing rounding issue with CapFarm

Default Out of Scope:

  • Issues found in previous security reviews,
  • Third-party contracts not under direct project control,
  • Issues with non-standard ERC20 tokens (unless explicitly supported by the project),
  • Rounding errors with no significant impact,
  • User errors requiring obviously incorrect parameter inputs,
  • Vulnerabilities that only manifest during extreme market conditions,
  • Incorrect data from third-party oracles
    • Note: Oracle manipulation and flash loan attacks are still in scope
  • Theoretical exploits without practical proof-of-concept,
  • Issues requiring access to leaked keys or credentials,
  • Issues arising from Sybil attacks
  • Centralization risks
  • Basic economic and governance attacks (such as 51% attacks)
  • Protocol design choices
  • Gas optimization issues and high gas costs
  • Best practice suggestions
  • Submissions generated using ChatGPT or other LLM tools