infinifi-protocol

infinifi-protocol

@infinifi
LiveCantina-Triaged

Maximum reward

$100,000

Severity

Max. Reward

Critical

$100,000

High

$15,000

Deposit required

$50

Findings submitted

348

Start date

8 Jun 2025

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Core Smart Contract CodeWeb Interface / Application:CoreFarmsOraclesTokens

Severity

Min and Max Reward

Critical

Up to $100,000

High

Up to $15,000

List of active protocol farms.

Name
Description
Asset
FARM_LIQUIDATION_V2

Handles liquidation-based yield capture

0xda…1A11

FARM_CAP_LIQUID_V2

Cap protocol liquid yield strategy v2

0xAc…b694

FARM_SWAP_V2

CoW Protocol swap-based yield strategy

0xeb…6fd7

FARM_MORPHO_SENTORA_PYUSD

Morpho Sentora PYUSD lending vault

0x84…E4EE

FARM_SILVER

RWA credit strategy (Silver counterparty)

0x27…84C1

FARM_FALCONX

FalconX prime broker lending allocation

0xe9…81Cf

FARM_MORPHO_SENTORA_PRIME_MAIN

Morpho Sentora Prime main USDC lending vault

0x75…568E

FARM_MAPLE_INSTITUTIONAL

Maple Finance institutional lending pool

0xF5…63B3

FARM_SPARK_SUSDC_V2

Spark Protocol sUSDC yield strategy v2

0xd8…e563

FARM_AAVEV3_HORIZON_USDC

Aave v3 Horizon USDC supply strategy

0x81…E032

FARM_FASANARA_GENESISFUND

Fasanara Genesis Fund RWA allocation

0x9E…1852

FARM_CAP_V2

Cap protocol yield strategy v2

0xe9…1eA4

FARM_MORPHO_INFINIFI_USDC

Morpho InfiniFi-curated USDC lending vault

0x76…5B78

FARM_TEMP_OTC

Temporary OTC desk allocation

0x04…3271

FARM_EULER_SENTORA_USDC

Euler Sentora USDC lending strategy

0x6F…07A5

FARM_FXSAVE

f(x) Protocol Save yield strategy

0xc9…eabc

FARM_MIDAS_MGLOBAL_V2

Midas mGlobal tokenized fund v2 (RWA)

0xF4…cecF

FARM_AAVEV3

Aave v3 USDC base supply strategy

0xbF…3580

FARM_AAVE_V4_USDG

Aave V4 USDG Global Dollar Network

0x2C…7657

FARM_PRIME_BROKER

3F Protocol prime broker auction strategy

0xfD…3dE4

Out of scope

Out-of-Scope Targets:

  • Contracts listed in addresses.1.json that are deployed by third parties, like ERC20_USDC, ROUTER_PENDLE, … InfiniFi’s deployer address is 0xdecaDAc8778D088A30eE811b8Cc4eE72cED9Bf22 and all our contracts are verified on Etherscan
  • api.infinifi.xyz
  • Issues described in previous audit reports (Spearbit, Certora, Cantina), reports are available on our documentation website.
  • Ongoing rounding issue with CapFarm

Default Out of Scope:

  • Issues found in previous security reviews,
  • Third-party contracts not under direct project control,
  • Issues with non-standard ERC20 tokens (unless explicitly supported by the project),
  • Rounding errors with no significant impact,
  • User errors requiring obviously incorrect parameter inputs,
  • Vulnerabilities that only manifest during extreme market conditions,
  • Incorrect data from third-party oracles
    • Note: Oracle manipulation and flash loan attacks are still in scope
  • Theoretical exploits without practical proof-of-concept,
  • Issues requiring access to leaked keys or credentials,
  • Issues arising from Sybil attacks
  • Centralization risks
  • Basic economic and governance attacks (such as 51% attacks)
  • Protocol design choices
  • Gas optimization issues and high gas costs
  • Best practice suggestions
  • Submissions generated using ChatGPT or other LLM tools