<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

Centralized Control of Contract Upgrade

Centralization Risks in IndexBetting.sol

Unlimited Staking Token Approval

Third Party Dependencies

Usage on Withdrawal Functions Not Differentiated

Missing Emit Events

Missing Sanity Check on Challenge Outcome Setting

Function `startBettingChallenge()` can be used for updates

Phuture.Finance (Audit v2)

IndexBetting.sol

Incompatibility With Deflationary Tokens(Swap)

Privileged functions allow DEFAULT_ADMIN_ROLE to potentially withdraw tokens

Centralization Related Risks

Privileged functions allow DEFAULT_ADMIN_ROLE to set malicious contracts to potentially withdraw tokens

Privileged functions allow owner to withdraw tokens

Privileged function allow MINTER_ROLE to mint PHTR tokens

Potentially incorrect number

Unnecessary and improper proxy

Beacon proxy pattern should be used instead of `Clones`

Usage of dangerous low level `delegatecall()`

Assets must be validated during index creation

UniswapV2Router02 should be used

No Cap on Fees

Privileged function allows DEFAULT_ADMIN_ROLE to upgrade contracts to potentially withdraw tokens

Lack of storage gap in upgradeable contracts

Divide before multiply

Missing `UUPSUpgradeable` initialization

Final upgradeable contract should have initializer constructor

Low level contract creation code

Lack of validation on price

No access restriction on function `withdraw()`

Incompatibility with UUPS implementation

Beacon proxy pattern should be used

Lack of access restriction on functions `mint()` and `burn()`

Index mint/burn calculation may be incorrect after reweighting adds/removes assets

Potential DOS attack

Lack of input validation may allow hackers to steal funds

Index creation should only be done by privileged roles in index factory

Incompatible with asset tokens with different decimals

Usage of `assert()`

Incorrect array length

Order history is lost

Unclear distribution of value loss due to price slippage

`PhutureERC20` should extend existing `ERC20Permit` from OpenZeppelin

Initial Token Distribution

Message/Signature replay attack

Upgradeable contract extends non-upgradeable contract

Approve/TransferFrom mechanism should be used

Initial values in field declarations

Incorrect condition check

Function `virtualTotalAssetSupply()` should be used instead of `totalAssetSupply()`

No access restriction on vToken creation

Significant difference from upstream Uniswap code

Potential overflow of math operations

Unused local variable

Conversion from uint256 to uint112

Phuture

projects

phuture-contracts-a229d0ff8bcc1556f35b67c83b7dd2339058f4c0

contracts

FeePool.sol

PhutureJob.sol

libraries

ValidatorLibrary.sol

Math.sol

VestingLibrary.sol

UQ112x112.sol

IndexLibrary.sol

NAV.sol

BP.sol

TransferHelper.sol

UniswapV2Library.sol

AUMCalculationLibrary.sol

UniswapV2PriceImpactLibrary.sol

TrackedIndexFactory.sol

IndexLayout.sol

BaseIndexFactory.sol

BaseIndex.sol

TopNMarketCapCategories.sol

ManagedIndex.sol

vPHTR.sol

ReweightingCredit.sol

IndexRegistry.sol

PhutureERC20.sol

IndexLogic.sol

UniswapV2PriceOracle.sol

vToken.sol

vTokenFactory.sol

TrackedIndex.sol

PHTRRouter.sol

Orderer.sol

UniswapV2PathPriceOracle.sol

vTokenProxy.sol

PhutureIndex.sol

ManagedIndexFactory.sol

TopNMarketCapIndex.sol

NameRegistry.sol

GovernableIndex.sol

SharedOwnershipCreator.sol

FixedAmountVesting.sol

GovernableIndexFactory.sol

PHTR.sol

ChainlinkPriceOracle.sol

IndexRouter.sol

ePHTR.sol

YearnVaultController.sol

PhuturePriceOracle.sol

BaseFeeGasPriceOracle.sol

BaseProxy.sol

GovernorFactory.sol

TopNMarketCapIndexFactory.sol

BaseVaultController.sol

Emission.sol

Top 10% Security Score

Top 10% Operation Score

Top 10% Fundamental Score

Leaderboards

Due Diligence Tools

Resources

KYC Status