Skip to content

Commit 42d7f2a

Browse files
github-actions[bot]github-actions[bot]
committed
Projects added or unpaused:
Projects removed or paused: Projects with updates: #decentraland #lombard-finance
1 parent 9362569 commit 42d7f2a

3 files changed

Lines changed: 23351 additions & 23443 deletions

File tree

‎project/decentraland.json‎

Lines changed: 12 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -834,7 +834,6 @@
834834
"pocPerTypeAndSeverity": [
835835
"smart_contract - high",
836836
"smart_contract - medium",
837-
"smart_contract - low",
838837
"websites_and_applications - critical",
839838
"websites_and_applications - high",
840839
"websites_and_applications - medium"
@@ -862,7 +861,7 @@
862861
"rewardsToken": "MANA, USDT",
863862
"slug": "decentraland",
864863
"tenPercentEconomicRule": false,
865-
"updatedDate": "2026-08-05T15:20:23.125Z",
864+
"updatedDate": "2026-08-23T09:12:27.139Z",
866865
"impactsBody": null,
867866
"websiteUrl": null,
868867
"githubUrl": null,
@@ -885,6 +884,12 @@
885884
"severity": "high",
886885
"title": "Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield"
887886
},
887+
{
888+
"id": 6309,
889+
"type": "websites_and_applications",
890+
"severity": "medium",
891+
"title": "Changing sensitive details of other users (including modifying browser localStorage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, etc."
892+
},
888893
{
889894
"id": 2881,
890895
"type": "smart_contract",
@@ -921,12 +926,6 @@
921926
"severity": "high",
922927
"title": "Retrieving sensitive user information, like user’s credentials."
923928
},
924-
{
925-
"id": 2887,
926-
"type": "websites_and_applications",
927-
"severity": "high",
928-
"title": "Changing sensitive details of other users (including modifying browser localStorage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, etc."
929-
},
930929
{
931930
"id": 2888,
932931
"type": "websites_and_applications",
@@ -939,24 +938,6 @@
939938
"severity": "medium",
940939
"title": "Controlled loss of user assets"
941940
},
942-
{
943-
"id": 2892,
944-
"type": "websites_and_applications",
945-
"severity": "medium",
946-
"title": "Defacing the sites, totally or partially, resulting in unauthorized visual changes of the site which could impact multiple users."
947-
},
948-
{
949-
"id": 2893,
950-
"type": "websites_and_applications",
951-
"severity": "medium",
952-
"title": "Redirecting users to malicious websites without their consent (Open Redirect)"
953-
},
954-
{
955-
"id": 2894,
956-
"type": "websites_and_applications",
957-
"severity": "medium",
958-
"title": "Catalyst Content: Impersonation of a user to alter their stored content."
959-
},
960941
{
961942
"id": 2895,
962943
"type": "websites_and_applications",
@@ -974,47 +955,27 @@
974955
"type": "websites_and_applications",
975956
"severity": "critical",
976957
"title": "Performing malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions, stealing funds or assets."
977-
},
978-
{
979-
"id": 6252,
980-
"type": "smart_contract",
981-
"severity": "low",
982-
"title": "Unbounded gas consumption that lead to make the core contract functionality unusable"
983-
},
984-
{
985-
"id": 6253,
986-
"type": "smart_contract",
987-
"severity": "low",
988-
"title": "Temporary freezing of funds/assets for any amount of time"
989958
}
990959
],
991960
"rewards": [
992961
{
993-
"id": 49743,
962+
"id": 50312,
994963
"primacy": null,
995964
"severity": "high",
996965
"assetType": "smart_contract",
997966
"maxReward": 500000,
998967
"rewardModel": "up_to"
999968
},
1000969
{
1001-
"id": 49744,
970+
"id": 50313,
1002971
"primacy": null,
1003972
"severity": "medium",
1004973
"assetType": "smart_contract",
1005974
"maxReward": 20000,
1006975
"rewardModel": "up_to"
1007976
},
1008977
{
1009-
"id": 49745,
1010-
"primacy": null,
1011-
"severity": "low",
1012-
"assetType": "smart_contract",
1013-
"fixedReward": 1000,
1014-
"rewardModel": "fixed"
1015-
},
1016-
{
1017-
"id": 49746,
978+
"id": 50314,
1018979
"primacy": null,
1019980
"severity": "critical",
1020981
"assetType": "websites_and_applications",
@@ -1023,15 +984,14 @@
1023984
"otherImpactMaxReward": 0
1024985
},
1025986
{
1026-
"id": 49747,
987+
"id": 50315,
1027988
"primacy": null,
1028989
"severity": "high",
1029990
"assetType": "websites_and_applications",
1030-
"maxReward": 2000,
1031991
"rewardModel": "up_to"
1032992
},
1033993
{
1034-
"id": 49748,
994+
"id": 50316,
1035995
"primacy": null,
1036996
"severity": "medium",
1037997
"assetType": "websites_and_applications",

‎project/lombard-finance.json‎

Lines changed: 48 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -583,7 +583,7 @@
583583
"rewardsToken": "USDC",
584584
"slug": "lombard-finance",
585585
"tenPercentEconomicRule": false,
586-
"updatedDate": "2026-08-12T13:09:48.258Z",
586+
"updatedDate": "2026-08-23T13:16:25.259Z",
587587
"impactsBody": "Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.",
588588
"websiteUrl": "https://www.lombard.finance/",
589589
"githubUrl": "https://github.com/lombard-finance/",
@@ -606,10 +606,28 @@
606606
"customProhibitedActivities": [],
607607
"impacts": [
608608
{
609-
"id": 34,
609+
"id": 14,
610610
"type": "smart_contract",
611-
"severity": "low",
612-
"title": "Contract fails to deliver promised returns, but doesn't lose value"
611+
"severity": "critical",
612+
"title": "Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results"
613+
},
614+
{
615+
"id": 15,
616+
"type": "smart_contract",
617+
"severity": "critical",
618+
"title": "Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield"
619+
},
620+
{
621+
"id": 17,
622+
"type": "smart_contract",
623+
"severity": "critical",
624+
"title": "Permanent freezing of funds"
625+
},
626+
{
627+
"id": 22,
628+
"type": "smart_contract",
629+
"severity": "critical",
630+
"title": "Protocol insolvency"
613631
},
614632
{
615633
"id": 23,
@@ -635,12 +653,6 @@
635653
"severity": "high",
636654
"title": "Permanent freezing of unclaimed royalties"
637655
},
638-
{
639-
"id": 49,
640-
"type": "websites_and_applications",
641-
"severity": "high",
642-
"title": "Subdomain takeover without already-connected wallet interaction"
643-
},
644656
{
645657
"id": 29,
646658
"type": "smart_contract",
@@ -660,47 +672,29 @@
660672
"title": "Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)"
661673
},
662674
{
663-
"id": 5081,
664-
"type": "smart_contract",
665-
"severity": "high",
666-
"title": "Temporary freezing of funds (over 10 Days)"
667-
},
668-
{
669-
"id": 14,
670-
"type": "smart_contract",
671-
"severity": "critical",
672-
"title": "Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results"
673-
},
674-
{
675-
"id": 15,
675+
"id": 32,
676676
"type": "smart_contract",
677-
"severity": "critical",
678-
"title": "Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield"
677+
"severity": "medium",
678+
"title": "Theft of gas"
679679
},
680680
{
681-
"id": 17,
681+
"id": 33,
682682
"type": "smart_contract",
683-
"severity": "critical",
684-
"title": "Permanent freezing of funds"
683+
"severity": "medium",
684+
"title": "Unbounded gas consumption"
685685
},
686686
{
687-
"id": 22,
687+
"id": 34,
688688
"type": "smart_contract",
689-
"severity": "critical",
690-
"title": "Protocol insolvency"
689+
"severity": "low",
690+
"title": "Contract fails to deliver promised returns, but doesn't lose value"
691691
},
692692
{
693693
"id": 35,
694694
"type": "websites_and_applications",
695695
"severity": "critical",
696696
"title": "Execute arbitrary system commands"
697697
},
698-
{
699-
"id": 37,
700-
"type": "websites_and_applications",
701-
"severity": "critical",
702-
"title": "Taking down the application/website"
703-
},
704698
{
705699
"id": 41,
706700
"type": "websites_and_applications",
@@ -720,23 +714,23 @@
720714
"title": "Injection of malicious HTML or XSS through metadata"
721715
},
722716
{
723-
"id": 32,
724-
"type": "smart_contract",
725-
"severity": "medium",
726-
"title": "Theft of gas"
727-
},
728-
{
729-
"id": 33,
730-
"type": "smart_contract",
731-
"severity": "medium",
732-
"title": "Unbounded gas consumption"
717+
"id": 49,
718+
"type": "websites_and_applications",
719+
"severity": "high",
720+
"title": "Subdomain takeover without already-connected wallet interaction"
733721
},
734722
{
735723
"id": 52,
736724
"type": "websites_and_applications",
737725
"severity": "medium",
738726
"title": "Redirecting users to malicious websites (open redirect)"
739727
},
728+
{
729+
"id": 5081,
730+
"type": "smart_contract",
731+
"severity": "high",
732+
"title": "Temporary freezing of funds (over 10 Days)"
733+
},
740734
{
741735
"id": 5082,
742736
"type": "websites_and_applications",
@@ -794,7 +788,7 @@
794788
],
795789
"rewards": [
796790
{
797-
"id": 49927,
791+
"id": 50323,
798792
"primacy": "primacy_of_impact",
799793
"severity": "critical",
800794
"assetType": "smart_contract",
@@ -804,7 +798,7 @@
804798
"rewardCalculationPercentage": 10
805799
},
806800
{
807-
"id": 49928,
801+
"id": 50324,
808802
"primacy": "primacy_of_impact",
809803
"severity": "high",
810804
"assetType": "smart_contract",
@@ -813,23 +807,23 @@
813807
"rewardModel": "range"
814808
},
815809
{
816-
"id": 49929,
810+
"id": 50325,
817811
"primacy": null,
818812
"severity": "medium",
819813
"assetType": "smart_contract",
820814
"fixedReward": 2500,
821815
"rewardModel": "fixed"
822816
},
823817
{
824-
"id": 49930,
818+
"id": 50326,
825819
"primacy": null,
826820
"severity": "low",
827821
"assetType": "smart_contract",
828822
"fixedReward": 1000,
829823
"rewardModel": "fixed"
830824
},
831825
{
832-
"id": 49931,
826+
"id": 50327,
833827
"primacy": null,
834828
"severity": "critical",
835829
"assetType": "websites_and_applications",
@@ -839,15 +833,15 @@
839833
"otherImpactMaxReward": 0
840834
},
841835
{
842-
"id": 49932,
836+
"id": 50328,
843837
"primacy": null,
844838
"severity": "high",
845839
"assetType": "websites_and_applications",
846840
"fixedReward": 10000,
847841
"rewardModel": "fixed"
848842
},
849843
{
850-
"id": 49933,
844+
"id": 50329,
851845
"primacy": null,
852846
"severity": "medium",
853847
"assetType": "websites_and_applications",

0 commit comments

Comments
 (0)