Kuru Bug Bounty

Out of Scope

• Vault DOS with low liquidity

  • The vault can be DOSed at very low liquidity where it becomes infeasible to place taker orders or place liquidity at a desired price.
  • This is a known issue and at low available sizes, the orderbook stops routing through the AMM vault. This is a known and accepted issue.
  • The market deployer is responsible for setting the initial liquidity and should be aware of this limitation.

• Issues from badly set market parameters

  • Issues arising from badly set market parameters are not in scope. The market deployer is responsible for choosing appropriate parameters as it is difficult to set the same without price information.

• Market DOS by bypassing minimum order size through flip orders

  • A market can be temporarily DOSed by bypassing the minimum order size through filling flip orders.
  • However, this is difficult to perform in an actively trading market and requires a large amount of funds to be locked up.
  • Therefore, this issue is out of scope.

• Price oracle related issues in KuruForwarder

  • The price dependent requests in KuruForwarder does a direct check on the price of the market instead of relying on a TWAP oracle.
  • This is known and accepted, the responsibility of fulfilling EIP712 requests lies with the user or customized relayer. Similarly, the kind of price comparisons made in the price dependent requests are intentional.