Inverse Finance

Overview

Inverse Finance is a decentralized autonomous organization that develops and manages the FiRM fixed-rate lending protocol and DOLA, a debt-backed decentralized stablecoin. Originally founded by Nour Haridy in late 2020, the protocol is now governed by Inverse Finance DAO, a collective of crypto enthusiasts.

Main Products:

• FiRM - A fixed-rate lending market
• DOLA - A stablecoin pegged to the US Dollar
• DBR - A DeFi primitive that enables holders to service DOLA loans on FiRM
• INV - Governance token for on-chain DAO voting
• sDOLA - Yield-bearing DOLA savings vault
• jrDOLA - Junior tranche providing bad debt protection for FiRM

Resources:

• Website: https://www.inverse.finance/ (opens in a new tab)
• Documentation: https://docs.inverse.finance/inverse-finance/ (opens in a new tab)
• Risk Working Group: https://docs.inverse.finance/risk-working-group-digest/ (opens in a new tab)
• Codebase: https://github.com/InverseFinance (opens in a new tab)

Reward Amounts

Rewards are paid in DOLA on Ethereum, denominated in USD. The calculation of funds at risk is based on the time and date the bug report is submitted.

Severity Criteria

Critical

• Definite and significant loss of funds without limitations of external conditions
• Definite and significant freezing of funds for >1 year without limitations of external conditions
• Unauthorized minting of INV, DOLA, or DBR tokens on-chain
• Private key or private key generation leakage leading to unauthorized access to user funds

High

• Theft or permanent freezing of unclaimed yield/royalties
• Temporary freezing of funds (reward doubles for every additional 24h frozen, up to max high reward)

Medium

• Issues requiring extensive constraints (e.g., extreme slashing scenarios as precondition)

Low

• Minor issues with limited impact

General Notes

• Sherlock's Criteria for Issue Validity (opens in a new tab) (docs.sherlock.xyz) guide can be a helpful resource but nothing in the guide should overrule the definitions above
• A coded Proof of Concept (PoC) with instructions to run is required for all severities
• If the protocol team can take measures (upgrade, pause, etc.) against an exploit, potential damage is limited to a 1-hour exploit period before mitigation is assumed

Known Issues & Out of Scope

The following are known issues and will not be rewarded:

1. Delegator griefing - Potential for griefing through manipulation of the delegator parameter in delegateBySig function (MultiDelegator, XINV, etc.)

2. Escrow initialization - Submissions related to missing initialization on Escrow implementation contracts are invalid. Contracts are cloned and correctly initialized per user at first deposit; proxies are properly initialized on creation.

3. Legacy contract interactions - Some active contracts interact with older Inverse Finance contracts (Anchor, Frontier). While active contracts are in scope, deprecated components are no longer maintained and do not represent real security risks. Verify all components in an exploit path are active and in-scope.

4. Vault share inflation - The vault share inflation attack is known. The protocol team will deposit on deployment; if an attacker front-runs, a new vault will be deployed.

5. Bad debt exceeding slashable amount - It's known that if bad debt exceeds the total slashable amount from junior tranche, users won't be able to withdraw (besides new deposits or accruing rewards).

6. Extreme slashing scenarios - Repeated slashing and deposits causing share deflation are known. These are considered failure of risk parameterization. Slashing is "extreme" if:

   • All available funds are slashed, OR
   • Several slashing actions compound to create share deflation exceeding 1,000,000x (≥1_million_e18 shares for 1e18 of underlying)
   • Issues requiring extreme slashing as precondition are Medium at max

7. Deposit bricking from extreme slashing - Known that extreme slashing will brick deposits due to share deflation up to total share limit. Issues requiring extreme slashing but unconnected to max total shares may be viewed as Medium at max.

Previous Audits

All completed audits: https://www.inverse.finance/audits (opens in a new tab)

Unfixed vulnerabilities mentioned in these reports are not eligible for a reward.

Additional Context

Chains in Scope

• Ethereum Mainnet

Expected Tokens

• DOLA - Standard ERC-20
• DBR - ERC-20 with special behavior for FiRM borrowing

Trusted Roles

• Gov - Trusted
• Operator - Trusted to set reward budget within Gov constraints

Offchain Mechanisms

A slasher observes the chain for bad debt and slashes jrDOLA depositors. DOLA holders and the Inverse Finance DAO are incentivized to do this to protect DOLA backing/peg. Assume slashing will always happen in a timely manner.

Eligibility Requirements

A coded Proof of Concept (PoC) with instructions to run is required for all severities. Submissions must include:

• A clear description of the vulnerability
• The affected contract(s) and function(s)
• A coded proof of concept with instructions to run, demonstrating a realistic attack path
• An assessment of impact under real-world conditions

Report standards

• Each report should include one vulnerability. If you identify several vulnerabilities, submit them as separate reports.
• Information the Inverse Finance team includes on this bug bounty page or in code comments may be used as context when reviewing reports. Where this page and code comments contradict each other, this page is the primary source of truth. The team may decide that code comments are outdated, in which case the default guidelines apply.
• Duplicates: a report that duplicates a previously submitted report is not rewarded, even if the issue had not been fixed before the later submission. The submission timestamp decides which report came first. Duplication is judged by root cause.

Resources

https://docs.inverse.finance/inverse-finance/ (opens in a new tab)
https://docs.inverse.finance/risk-working-group-digest/ (opens in a new tab)
https://www.inverse.finance/ (opens in a new tab)