Midas Bug Bounty

Standard out-of-scope items per the Cantina Bug Bounty Out-of-Scope Policy.

The following issues are out of scope and not eligible for rewards.

For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.

Token & Design Issues

• Issues related to non-compliant or weird ERC20 tokens
• Centralization related risks
• Issues related to the design philosophy of the protocol (e.g., trade-offs made on permissionless protocols)

Admin & User Errors

• Issues based on admin errors, such as calling a function with wrong parameters and admin actions on integrated protocols (note: issues based on a wrong implementation of admin functions will have the severity defined based on the severity matrix)
• Issues based on a malicious or compromised admin, unless explicitly included in the scope
• Issues based on a user error, without significant impact on other users

Theoretical & Speculative

• Speculation on future code, integrations, or upgrades unless the finding directly relates to current code and behavior
• Known issues by the team
• Theoretical vulnerabilities without proof of concept

Social & Physical

• Social engineering attacks or phishing
• Issues requiring physical access to a user's device or local network
• Attacks requiring MITM or physical access to a user's device
• Brute forcing account credentials

Low-Impact Web

• Self-XSS or non-exploitable UI/UX issues
• Clickjacking on pages with no sensitive actions
• Server information and status pages (e.g., stack traces, descriptive error messages)
• SSL/TLS best practices (e.g., missing SSL Pinning, insecure configurations)
• Optional email security features (e.g., SPF/DKIM/DMARC configurations)
• Most issues related to rate limiting
• Content-Security-Policy configuration opinions
• Verbose error messages without proof of exploitability
• Content spoofing, text injection
• Missing HTTP Only flags on non-sensitive cookies
• Tabnabbing
• Self-exploitation (e.g., self-XSS, self-DoS, cookie reuse)

General Exclusions

• Best practice recommendations or feature requests
• Third-party integrations or dependencies not under Midas's control
• Denial of Service (DoS) attacks without demonstrated impact
• Reports from automated tools or scans
• Known vulnerable libraries without a working proof of concept
• Open access to publicly-exposed resources (e.g., Google Sheets) without demonstration of vulnerability exploitation
• Issues without clearly identified security impact