Paraclear - Manages all positions and balance accounting

Vault - Pool users’ assets for the Vault feature

Factory - Initializing new vaults and their configs

Registry - Maintains a record of roles on the platform

Oracle - Provides up-to-date pricing for all markets

L1 Bridge - Fork with minor adjustments to Starknet Bridge

__Code Freeze Assurance__

Code of the assets in scope is frozen while the program is live.

Duplicate submissions of bugs are valid. Duplicate submissions of Insights are invalid.

The project commits to keeping private all info related to bug findings until this program is over. This means the project will not leak info about any bug findings or planned bug fixes, including bug findings found independently by the project or from concurrent private audits.

__Insight Reporting__

Insight reports may be reported to this program and do not require a PoC. Insights are rewarded according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

__Asset Accuracy Assurance__

Bugs found on assets incorrectly listed in-scope are valid.

__Private Known Issues Reward Policy__

Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

__Eligibility Criteria__

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFACs SDN list 
- Official contributor, both past or present
- Employees and/or individuals closely associated with the project 
- Security auditors that directly or indirectly participated in the audit review

__Dispute Resolution__

If there is any dispute over bug reports between projects and security researchers, Immunefi has final say on validity and severity based on the terms of this program.

__Responsible Publication Policy__

Immunefi will publish bug reports, earnings, and a leaderboard for this Invite Only Program. Security Researchers may publish their bug reports as well, but only after Immunefi has published the valid bug reports as part of the competition results.

shaflow1

Catchme

Kalogerone

https://drive.google.com/file/d/1iizXoQeXiOiqUW25lt0v

Paradex is a high-performance crypto-derivatives exchange built on a Starknet Appchain. 

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Contract fails to deliver promised returns, but doesn't lose value

Theft of gas

Unbounded gas consumption

Temporary freezing of funds for at least 24 hour

Temporary freezing of funds for at least 1 hour

__Build Commands, Test Commands, and How to Run Them__

Included in repo readme

__Previous Audits__

Paradex’s completed audit reports can be found at [https://github.com/Cairo-Security-Clan/Audit-Portfolio/blob/main/Paradex_Audit_Report.pdf](https://github.com/Cairo-Security-Clan/Audit-Portfolio/blob/main/Paradex_Audit_Report.pdf). Unfixed vulnerabilities  mentioned in these reports are not eligible for a reward.

L1 Bridge contract is a fork of starknet’s starkgate bridge with some minor additions. Their audits are:
- [https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/Starknet_Core_Summary_Report_Sept_2022.pdf](https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/Starknet_Core_Summary_Report_Sept_2022.pdf)
- [https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/StarkGate_Oct_2023.pdf](https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/StarkGate_Oct_2023.pdf)
- [https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/StarkGate_Oct_2024.pdf](https://github.com/tradeparadex/paradex-docs/blob/main/fern/assets/StarkGate_Oct_2024.pdf)

__Private Known Issues Reward Policy__

Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

__Optional Project Info__

**Is this an upgrade of an existing system? If so, which? And what are the main differences?**

Mainnet is currently running a slightly newer version of the code that’s being audited.

Starkgate contract is running exactly the same as the repo on mainnet

**Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?**

Attack Vectors:
- Stealing User Funds / Unauthorized fund transfers
- Market Manipulation

**What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported?**

ERC20

**Which chains and/or networks will the code in scope be deployed to?**

We currently run on a starknet app chain

**What external dependencies are there?**

Openzeppelin, Alexandria Data Structures

**Are there any unusual points about your protocol that may confuse Security Researchers?**

Potentially, the way some transfer restrictions are implemented and some of the functionalities implemented on Vaults can be quite complex 

**What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc)**

- [https://docs.paradex.trade/](https://docs.paradex.trade/)
- [https://l2beat.com/scaling/projects/paradex](https://l2beat.com/scaling/projects/paradex)

__Rewards Terms__

Rewards are distributed among SRs according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

Rewards are denominated in USD and distributed in USDC on Ethereum.

The reward pool is $33k USD if any bug is found.

If not a single bug is found (Insights do not count as bugs) the reward pool is $2.97k USD

On top of this, each participating SR will receive a guaranteed reward of $3k USD.

**Proof of Concept (PoC) Requirements**

For this program, runnable PoC code is not required. Whitehats are instead required to write a step-by-step explanation of the PoC and impact.

__Insight Rewards Payment Terms__

*Insight Rewards*: Portion of the Rewards Pool

*The "Insight" severity was introduced on Boost (Audit Competitions) & Attackathon programs to recognize contributions that extend beyond identifying immediate vulnerabilities. Currently, it's not an option to select the Insight severity when submitting a report. However, our team or program will designate it accordingly if applicable. "Insights" underscores our commitment to valuing all types of contributions that contribute to a more secure environment and will always be rewarded. [View more information about Insights](https://immunefisupport.zendesk.com/hc/en-us/articles/13333032674961-Severity-Classification-System?utm_source=immunefi)

Duplicates of Insight reports are not eligible for a reward.

NAME	EARNINGS	TOTAL VALID BUGS	CRITICAL	HIGH	MEDIUM/LOW	INSIGHTS
1	$17,842	7	2	0	5	5
2	$8,421	1	1	0	0	8
3	$4,401	3	0	2	1	3
4	$2,336	6	0	0	6	1

IOP | Paradex

Status

Status