<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

Free Token Mint in Function `transferInVault()` and `depositIn()`

Low-level Call Will Not Be Reverted on EOAs 

Insecure Hash-to-Point Function Could Possibly Cause Signature Forgery

Logic Flaw In `withdraw()`

Centralization Risks in Near LightClients Module 

Centralization Risks in MapClients Module 

Centralization Risks in MCS/MOS Module 

Possibly Multiple Logs of Same Type in Function `decodeNearLog()` and `decodeNearDepositLog()`

Improper Use of Equality Checking

Incorrect Correspond Token Balance Calculation

Incorrect Decode of Near Logs to `transferOutEvent` and `nearDepositOutEvent`

Potential DOS Attack

Inaccurate Sanity Check for `epoch_id`

 Variable `success` Is Overwritten

Incorrect Number Encoding

`amount` Should Be `outAmount`

Inaccurate Parameter of `mapTransferIn` Event

Lack of Checks for Numeric Inputs

Incompatibility with Deflationary Tokens

Missing Zero Address Validation

Missing Ed25519 Input Validation

Potential Risk of Locked Funds

Missing Zero Address Input Validation

Lack of Access Control over `doDistribute()` Function

Potential Logic Flaw in `getTokenFee`

Potential Risk of Locked Admin

Hardcoded Validator Size Inconsistency

Possible Out-of-bound Error in Function `getValidator()`

Lack of Checking the Required Decimal

Potential Index Out of Bound

Missing Input Validation for `chainId`

Inaccurate Validation of Near Account

`toChainToken` Could Possibly be An Unknown Address for Unregistered Tokens

Potential Division By Zero

Inaccurate Representation of `correspondBalance`

Lack of Manager Role in Some Scenarios

Potential Signature Verification Error

Usage of Magic Numbers

Missing Input Validation for `extra.length`

Unused Events

Usage of `block.chainId` Preferred over Assembly

Use Variables to Save Gas

Unused State Variables

Unused Interfaces

Use Variables of  `ls[i].toList()` and `ls[i].toList()[1].toList()` for Gas Optimization

Use Variable of `ls[1].toList()` for Gas Optimization

Inefficient Usage of Function `burn()`

Redundant Variable `remaining` in Function `collectChainFee()` 

Unused Function `setVaultValue()`

Unused  Variable `vaultBalance` and Function `setVaultBalance()`

Variable Can Be Declared As `constant`

Unnecessary Length Check

Unnecessary Variable Usage

`for` Loop Optimization

Inconsistencies between Use of `msg.sender` and `from` Address

Redundant Check

Missing Emit Events

Unimplemented `transferOut()` Functions

Redundant Import Files

Functions with `_` as Name Prefix Are Not `private` Or `internal`

Unlocked Compiler Version

Typos Present in Code 

Missing Error Messages

Require Condition Could be Simplified

Inconsistent Constant Size for Block Producers

Non-standard RLP Formatting

Inaccurate Event Parameter

Redundant Modifier `payable`

Discussion on Function `hexStrToBytes()`

Inconsistent Splitting Logic

Possible Inconsistency Caused by Being Hashed Twice 

Map Protocol

IFeeCenter.sol

IFeeNFT.sol

ILightClientManager.sol

ILightNode.sol

ILogs.sol

IMAPToken.sol

IMCS.sol

IMCSReceiveData.sol

IMCSRelay.sol

IRelayer.sol

ITokenRegister.sol

IVault.sol

IWToken.sol

StandardToken.sol

ProxyAdmin.sol

RLPReader.sol

Role.sol

TransferHelper.sol

TransparentUpgradeableProxy.sol

MAPVaultToken.sol

VERC20.sol

FeeCenter.sol

MAPCrossChainServiceRelay.sol

MapCrossChainService.sol

TokenRegister.sol

BGLS.sol

BlsCode.sol

IBLSPoint.sol

ILightNodePoint.sol

IVerifyTool.sol

IWeightedMultiSig.sol

MPT.sol

MPTTest.sol

RLPEncode.sol

LightNode.sol

LightNodeProxy.sol

VerifyTool.sol

Borsh.sol

Ed25519Verify.sol

NearDecoder.sol

ProofDecoder.sol

Utils.sol

Centralization Related Risks for the Contract Authority

Potential overflow on method parameters serialization

Inconsistent Comment and Code

Insecure Hash to Point function

Typos

Unnecessary Type Conversion Operations

Needless Borrow

Length Comparison With Zero

Wrong precomputed constant

Code Duplication

Missing Input Validation on Map Light Client initialization

`TODO` Statement

Unclear Error Message

Missing Log Events

Incorrect Variable Naming

Unneeded `return` statement 

Unused Non-Public Function

Needless Collect

Missing Storage Deposit Refund

No Need Attach Deposit

Unnecessary to Minus 1 yoctoNear 

Missing `FungibleToken` Storage Deposit Refund

Failed Cross-Chain Transfer

Inaccurate Error Message

Dangling commented code

Unnecessary "+ 1" with greater or equal comparison

Unnecessary `let` Binding

Unnecessary Unwrap

Use `unwrap_or` Followed by Call to `default`

Unnecessary `assert_self` for Private Methods

Needless Mutable Reference 

Broken unit and integration tests

Mismatch on methods name for Access Key authorization

Missing check on full access key receiver

Centralization Related Risks

Unused code

Unused Imports

Missing full access key validation for sensitive methods

Redundant `else` Statement

Unnecessary Braces For `Serializer`

Redundant Closure

Redundant Clone

Test Only Code

Map Protocol - Near

bytes.rs

mod.rs

rlp.rs

errors.rs

header.rs

istanbul.rs

proof.rs

crypto.rs

lib.rs

macros.rs

traits.rs

Cargo.toml

event.rs

prover.rs

Cargo.lock

Top 10% Security Score

Top 10% Code Security Score

Top 10% Governance Score

Top 10% Community Score

Top 10% Market Score

Top 10% Operation Score

Top 10% Fundamental Score

The Provably Secure Omnichain Layer of Web3.

MAP Protocol

Leaderboards

Due Diligence Tools

Resources

KYC Status