Bug Bounty Report Review Command

Bug Bounty Report Review Command

Usage: /review-bounty-report (then paste the bug bounty report and any platform AI analysis into the chat)

Purpose

Perform a structured, skeptical review of a Cantina bug bounty submission. Challenge every claim (vulnerability, impact, scope, severity, fix). Use the codebase, docs, audit metadata, and external protocol docs as sources of truth. Output is log only (no file written).

Inputs

• Required: Full text of the bug bounty report (and, if present, the platform's AI analysis in any format—interpret freely, no fixed structure assumed).
• Optional: Program URL for reference; specific commit or file paths the reporter cited; pasted or attached audit report text when comparing to a prior audit.

Audit PDFs: The agent cannot read PDFs from the repo. Use audit/auditLog.json to identify relevant audits. If the report concerns an audited contract, list those audit report paths and add a Manual task to open the PDF(s) and check for the same/similar findings. If the user attaches or pastes audit report text, use it in the comparison.

Program Scope (LI.FI Cantina Bounty)

Program reference: https://cantina.xyz/code/260585d8-a3e8-4d70-8077-b6f3f5f0391b/overview

In-Scope

• Smart contracts: Repo github.com/lifinance/contracts, latest commit, files src/**/*.sol.
• Case-by-case: Vulnerabilities in components not explicitly listed but that pose risk to user funds, user data, or system integrity.

Out-of-Scope (abbreviated; check full program for exhaustive list)

• Bridge/DEX: Relayer latency; bridge fee fluctuations; cross-chain reorg theories; bridge liquidity limits; oracle price delays; slippage within tolerance; MEV/front-running; route optimization; gas-only; DEX availability.
• Contracts: Centralization by design; non-exploitable reentrancy; flash loan without proof under realistic conditions; upgradeability-by-design; governance requiring >10% supply; known/acknowledged in audits; self-crafted calldata (our contracts expect backend-generated calldata); idle/dust in LiFiDiamond (not a vulnerability); cross-EVM address mismatch (non-prod); deprecated /archive; Lightchaser automated list; duplicates; atomic tx reverts; precision/dust reverts in integrations; third-party protocol bugs; known doc'd issues; test code; user error; theoretical no PoC; under remediation.
• Doc/minor: Doc discrepancies; missing events; missing zero-address checks; missing input validation—unless they lead to permanent fund loss or clear security impact.

Severity (Smart Contracts)

Impact (by % of daily total user transfers across all EVM chains):

• Critical: 50%–100% of daily total user transfers; governance.
• High: 20%–50%.
• Medium: 0.5%–20%; or serious reputational/legal/financial for many users.
• Low/Info: Minimal direct risk.