size-solidity

Size is a fixed-rate lending marketplace built on an order book where offers are expressed like yield curves, allowing efficient and continuous pricing across markets and maturities.

Scope

In-Scope Targets:

• Repository: https://github.com/SizeCredit/size-solidity
• Commit: 739250c26be314b0d74e670297a344b02be625d0
• Total LOC: 4301
• Files:: src/

If you discover a vulnerability in any component that is not explicitly listed but poses a risk to user funds, user data, or the integrity of the system, you may submit it for consideration. The team will review such submissions on a case-by-case basis.

Out-of-Scope Targets:

• Known issues:
  • Referenced on the project README and past audit reports

Documentation

• Size Credit Docs

Prohibited Actions

• No Unauthorized Testing on Production Environments:
  Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setups.

• No Public Disclosure Without Consent:
  Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.

• No Exploitation or Data Exfiltration:
  Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service.

• No Conflict of Interest:
  Individuals currently or formerly employed by [Program Name/Company], or those who contributed to the development of the affected code, are ineligible to participate.

Disclosure Requirements

Report must include:

• A clear description of the vulnerability and its impact.
• Steps to reproduce the issue, ideally with a proof of concept.
• Details on the conditions under which the issue occurs.
• Potential implications if the vulnerability were exploited.

Reports should be made as soon as possible—ideally within 24 hours of discovery.

Eligibility

To be eligible for a reward, you must:

• Be the first to report a previously unknown, non-public vulnerability within the defined scope.
• Provide sufficient information to reproduce and fix the vulnerability.
• Not have exploited the vulnerability in any malicious manner.
• Not have disclosed the vulnerability to third parties before receiving permission.
• Comply with all Program rules and applicable laws.

You must also be of legal age in your jurisdiction and not be a resident in a country under sanctions or restrictions, as required by applicable laws.

Severity and Rewards

Vulnerabilities are classified using two factors: Impact and Likelihood. The combination of these factors determines the severity and guides the reward amount.

Risk Classification Matrix

Severity Level	Likelihood: High	Likelihood: Medium	Likelihood: Low
Impact: High	Critical	High	Medium
Impact: Medium	High	Medium	Low
Impact: Low	Medium	Low	-

Impact Definitions:

• Critical:

  • Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results
  • Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
  • Permanent freezing of funds
  • Protocol insolvency

• High:

  • Theft of unclaimed yield
  • Permanent freezing of unclaimed yield
  • Temporary freezing of funds for more than 1 week

• Medium:

  • Smart contract unable to operate due to lack of token funds
  • Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
  • Unbounded gas consumption

• Low:

  • Contract functions affected but does not result in loss of fund or impact severely

Likelihood Definitions:

• High: Very easy to exploit or highly incentivized.
• Medium: Exploitation is possible under certain conditions.
• Low: Difficult to exploit or requires highly specific conditions.

Payout Guidelines

Risk Score	Maximum Payout	Minimum Payout (Optional)
Critical	$50,000	$10,000
High	$5,000	$1,000

Note: Actual reward amounts are determined at Size Credit’s sole discretion. Factors influencing payout include quality of report, completeness, and the severity and exploitability of the vulnerability.

Other Terms

By submitting a report, you grant Size Credit the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Size Credit. The terms, conditions, and scope of this Program may be revised at any time. All participants are responsible for reviewing the latest version before submitting a report.