Token Bridge Smart Contract Cracking Competition

Prize fund: Up to $50,000
Deadline: 18:00 UTC on December 30
Who can participate: Everyone

The Task is to identify potential vulnerabilities and issues in the FunC and Solidity smart contracts of Token Bridge.

Using this bridge, users can transfer any ERC-20 or BEP-20 tokens (for example, USDC or USDT) originally created on Ethereum or BNB Smart Chain to the TON Blockchain, with the ability to return them back.

The transferred tokens will be represented on TON as regular Jettons so that TON services, such as DEXs, will be able to work with them without any additional modifications.

Evaluation Criteria and Prize Fund Distribution:
Bounties are dependent on the severity of the discovered issues and could potentially range from $200 for bugs which do not affect economical safety to $25,000 for major flaws which can lead to Bridge insolvency or unconditional loss of assets by users. Prizes will be distributed in TONs.

Please focus on issues, conditions and attacks which could allow to bypass the smart contract's logic.

We are also interested in economic attack vectors to "ruin" oracles, given that oracles pay network fees.

Optimization of gas-usage or code-style improvements are out of the scope of this competition and will not be rewarded. Conditions when majority of validators or oracles (on any side of the bridge) are malicious or malfunctioning is out of the scope as well.

Details:

Description »

Solidity smart contracts »

FunC smart contracts »

Testnet bridge »

You can find useful unit tests in both smart contract repositories.

Submissions:

Submit a pull request on GitHub to Solidity or FunC bridge repo. Describe the issue as a comment to the pull request. Specify your TON wallet address to receive a prize.