Circuit

Circuit

@circuitdao
Live

Maximum reward

$20,000

Severity

Max. Reward

Critical

$20,000

High

$10,000

Medium

$2,000

No deposit required

Findings submitted

73

Start date

5 Nov 2025

Please sign in as a researcher to join the bounty.

Log in

In scope

Severity

Min and Max Reward

Critical

Up to $20,000


High

Up to $10,000


Medium

Up to $2,000


Low
Discretionary
Informational
Discretionary

We are providing an initial Statutes configuration (ISC), which defines the Statute values and constraints that the protocol will be launched with. The ISC is to be considered integral part of the protocol, and any vulnerability that results from the ISC is in-scope.

Initial Statutes Configuration (ISC):

  • Statutes no. 0, 1, 2, 4 and 33 should be considered out-of-scope as those values can only be set at the time of protocol launch.
  • Statutes no. 1 and 2 are discount factors given with PRECISION = 10,000,000,000. For example, if a Stability Fee of 5% per annum is desired at protocol launch, STATUTE_STABILITY_FEE_DF would be set to 10,000,000,928.
  • Statute value no. 3 should always be nil as it is not used for anything.
  • Statute no. 26 will in practice depend on the CRT market price, which is not known at the time of protocol deployment.
  • Statute no. 34 is deliberately being set to 0 at launch. Although it lowers the incentive for Announcers to behave well, it’s important to sign up a sufficient number of Announcers first.

Initial Statutes Configuration (ISC)

IndexStatuteAmount / ValueUnit
0STATUTE_ORACLE_LAUNCHER_IDset during protocol deployment
1STATUTE_STABILITY_FEE_DFdepends on market at time of launch
2STATUTE_INTEREST_DFdepends on market at time of launch
3STATUTE_CUSTOM_CONDITIONSn/a
4STATUTE_ORACLE_M_OF_Ndepends on number of governance-approved announcers at time of launch
5STATUTE_ORACLE_PRICE_UPDATE_DELAY21,600seconds
6STATUTE_ORACLE_PRICE_UPDATE_RATIO_BPS200bps
7STATUTE_PRICE_DELAY3,600seconds
8STATUTE_VAULT_MINIMUM_DEBT250,000mBYC
9STATUTE_VAULT_LIQUIDATION_RATIO_PCT166pct
10STATUTE_VAULT_LIQUIDATION_PENALTY_BPS1,300bps
11STATUTE_VAULT_INITIATOR_INCENTIVE_FLAT12,000mBYC
12STATUTE_VAULT_INITIATOR_INCENTIVE_BPS800bps
13STATUTE_VAULT_AUCTION_TTL2,400seconds
14STATUTE_VAULT_AUCTION_STARTING_PRICE_FACTOR_BPS12,000bps
15STATUTE_VAULT_AUCTION_PRICE_TTL150seconds
16STATUTE_VAULT_AUCTION_PRICE_DECREASE_BPS500bps
17STATUTE_VAULT_AUCTION_MINIMUM_PRICE_FACTOR_BPS2,500bps
18STATUTE_VAULT_AUCTION_MINIMUM_BID_FLAT1,000,000mBYC
19STATUTE_VAULT_AUCTION_MINIMUM_BID_BPS1,000bps
20STATUTE_TREASURY_MINIMUM0mBYC
21STATUTE_TREASURY_MAXIMUM10,000,000mBYC
22STATUTE_TREASURY_MINIMUM_DELTA20,000mBYC
23STATUTE_TREASURY_REBALANCE_RATIO_PCT400pct
24STATUTE_AUCTIONS_MINIMUM_PRICE_INCREASE_BPS500bps
25STATUTE_RECHARGE_AUCTION_TTL86,400seconds
26STATUTE_RECHARGE_AUCTION_MINIMUM_CRT_PRICE10,000,000dekaCRT/nanoBYC
27STATUTE_RECHARGE_AUCTION_BID_TTL1,200seconds
28STATUTE_RECHARGE_AUCTION_MINIMUM_BID1,000,000mBYC
29STATUTE_RECHARGE_AUCTION_MAXIMUM_BID10,000,000mBYC
30STATUTE_SURPLUS_AUCTION_LOT1,000,000mBYC
31STATUTE_SURPLUS_AUCTION_BID_TTL1,200seconds
32STATUTE_ANNOUNCER_REWARDS_INTERVAL_PRICE_UPDATES100updates
33STATUTE_ANNOUNCER_REWARDS_PER_INTERVALdepends on number of governance-approved announcers at time of launchmCRT
34STATUTE_ANNOUNCER_MINIMUM_DEPOSIT_MOJOS0mojos
35STATUTE_ANNOUNCER_MAXIMUM_VALUE_TTL900seconds
36STATUTE_ANNOUNCER_PENALTY_INTERVAL_MINUTES15minutes
37STATUTE_ANNOUNCER_PENALTY_PER_INTERVAL_BPS500bps
38STATUTE_ANNOUNCER_DISAPPROVAL_MAXIMUM_PENALTY_BPS2,500bps
39STATUTE_ANNOUNCER_DISAPPROVAL_COOLDOWN_INTERVAL7,776,000seconds
40STATUTE_GOVERNANCE_BILL_PROPOSAL_FEE_MOJOS1,000,000,000,000mojos
41STATUTE_GOVERNANCE_IMPLEMENTATION_INTERVAL21,600seconds
42STATUTE_GOVERNANCE_COOLDOWN_INTERVAL86,400seconds
43STATUTE_BLOCK_ISSUANCE0bool

If you discover a vulnerability in any component that is not explicitly listed but poses a risk to user funds, user data, or the integrity of the system, you may submit it for consideration. The team will review such submissions on a case-by-case basis.

Note: Actual reward amounts are determined at Voltage Technologies’s sole discretion. Factors influencing payout include quality of report, completeness, and the severity and exploitability of the vulnerability.

Out of scope

  • Expected behaviors such as trusted/untrusted roles and/or any accepted risks:
    • Data provider collusion
    • The majority of governance token holders colluding
  • Issues identified in previous security reviews (incl Cantina audit competition) that the team decided not to fix or address (usually because they were of low or informational severity). Note however that fixes to issues identified in previous security reviews are in-scope, i.e. fixes that did not eliminate the vulnerability or introduced a new one.
  • Web Interface / Application:
    • https://circuitdao.com
    • The app connects to a deployment of the protocol on Chia testnet11. The puzzles deployed are those of commit ID 1f2bf0396a5a1d538f9a5fccbcfc11cdacce8293. The app only exposes a subset of protocol operations. The full set of operations is accessible via the CLI: https://github.com/circuitdao/circuit-cli

Default Out of Scope: