Security
Last updated
Was this helpful?
Last updated
Was this helpful?
The security of the Hifi protocol is our outmost priority. Our team, accompanied by external auditors and consultants, has invested considerable effort to create a protocol that is safe and reliable. All contract code and balances are publicly verifiable in our , and security researchers are eligible for a bug bounty for reporting undiscovered vulnerabilities.
We engaged for a review and audit of our smart contract code. They reported discovering no major or medium-risk vulnerabilities, only a few that were low-risk. We addressed all of these in a subsequent update, which was reviewed by the third-party auditor.
This is the security assessment certificate issued by Quantstamp at the end of their review:
Audits are just one piece of the puzzle. To deliver a secure protocol, we believe that it is equally important to invest in and be wary of the following areas:
Testing infrastructure
Code coverage
Internal documentation (code comments)
Conformity to best practices
Minimizing complexity
We argue that our smart contract code ticks all the boxes.
Liquidating dangerous vaults is perhaps the most important on-chain operation in Hifi. When the value of a borrower's collateral falls below the collateralization ratio, the protocol allows any Ethereum account to liquidate the borrower's vault.
Anyone can be a liquidator on Hifi, but familiarity with the smart contract API is requisite. To automate the process, we wrote a liquidator bot that can be run on a cloud computing platform like AWS:
Security is core to our values, and we value the input of hackers acting in good faith to help us maintain the highest standard for the security and safety of the Ethereum ecosystem. The Hifi protocol, while it has gone through professional audits, depends on new technology that may contain undiscovered vulnerabilities.
Hifi encourages the community to audit our contracts and security; we also encourage the responsible disclosure of any issues. This program is intended to recognize the value of working with the community of independent security researchers, and sets out our definition of good faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.
Hifi offers substantial rewards for discoveries that can prevent the loss of assets, the freezing of assets, or harm to a user, commensurate with the severity and exploitability of the vulnerability. Hifi will pay a reward of $500 to $20,000 for eligible discoveries according to the terms and conditions provided below.
The primary scope of the bug bounty program is for vulnerabilities affecting the on-chain Hifi protocol, deployed to the Ethereum Mainnet, for contract addresses listed in this developer documentation.
This list may change as new contracts are deployed, or as existing contracts are removed from usage. Vulnerabilities in contracts built on top of the Protocol by third-party developers (such as smart contract wallets) are not in-scope, nor are vulnerabilities that require ownership of an admin key.
The secondary scope of the bug bounty program is for vulnerabilities affecting the Hifi Interface hosted at app.hifi.finance that could conceivably result in exploitation of user accounts.
Finally, test contracts (Kovan and other testnets) and staging servers are out of scope, unless the discovered vulnerability also affects the protocol or the Hifi Interface, or could otherwise be exploited in a way that risks user funds.
Submit all bug bounty disclosures to [email protected]. The disclosure must include clear and concise steps to reproduce the discovered vulnerability in either written or video format. Hifi will follow up promptly with acknowledgement of the disclosure.
To be eligible for bug bounty reward consideration, you must:
Identify an original, previously unreported, non-public vulnerability within the scope of the Hifi bug bounty program as described above.
Include sufficient detail in your disclosure to enable our engineers to quickly reproduce, understand, and fix the vulnerability.
Be at least 18 years of age.
Be reporting in an individual capacity, or if employed by a company, reporting with the company’s written approval to submit a disclosure to Hifi.
Not be subject to US sanctions or reside in a US-embargoed country.
Not be a current or former Hifi employee, vendor, contractor, or employee of a Hifi vendor or contractor.
To encourage vulnerability research and to avoid any confusion between good-faith hacking and malicious attack, we require that you:
Play by the rules, including following the terms and conditions of this program and any other relevant agreements. If there is any inconsistency between this program and any other relevant agreements, the terms of this program will prevail.
Report any vulnerability you've discovered promptly.
Avoid violating the privacy of others, disrupting our systems, destroying data, or harming user experience.
Use only [email protected] to discuss vulnerabilities with us.
Keep the details of any discovered vulnerabilities confidential until they are fixed.
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope.
Only interact with accounts you own or with explicit permission from the account holder.
Not engage in blackmail, extortion, or any other unlawful conduct.
When working with us according to this program, you can expect us to:
Pay generous rewards for eligible discoveries based on the severity and exploitability of the discovery, at Hifi's sole discretion.
Extend Safe Harbor for your vulnerability research that is related to this program, meaning we will not threaten or bring any legal action against anyone who makes a good faith effort to comply with our bug bounty program.
Work with you to understand and validate your report, including a timely initial response to the submission.
Work to remediate discovered vulnerabilities in a timely manner.
Recognize your contribution to improving our security if you are the first to report a unique vulnerability, and your report triggers a code or configuration change.
All reward determinations, including eligibility and payment amount, are made at Hifi's sole discretion. Hifi reserves the right to reject submissions and alter the terms and conditions of this program.
Hifi is relying on the for gather price data for Erc20 assets. At the time of writing this section, Chainlink is the leading oracle network for Ethereum smart contracts.
The liquidation flow of Hifi is similar to 's, in that there is no auction. There is a liquidationIncentive field in the BalanceSheet contract, which is part of a formula that calculates the amount of collateral that liquidators earn when successfully liquidating a vault. For example, if the incentive is 10% and the value of the collateral is $5,000, the liquidator would earn $500 worth of collateral.
