Skip to main content
Avana logo

Bug Bounty

Responsible disclosure scope and economic-impact triage guidance for Avana security research.

Overview

The Avana Bug Bounty covers responsible disclosure across contracts, risk systems, and supporting infrastructure that can affect user funds or protocol solvency.

Because Avana uses AMM liquidity positions as collateral, scope includes both direct contract bugs and failures where liquidity, pricing, or market state can be turned into bad collateral value or broken liquidations.

Severity is economic first: rewards track exploitability and outcomes such as fund loss, insolvency, bad debt, or systemic collateral mispricing, not only how large the code change looks.

Scope & System Architecture

Scope is split into subsystems so researchers can map a finding to the part of the stack it actually threatens: core lending, LP valuation, governance and admin, or offchain integrations.

Program A - Core Lending

Covers the primary credit engine where accounting integrity, collateralization, and liquidation execution directly protect user funds.

Includes

  • Deposit / withdraw flows
  • Borrow / repay logic
  • Health factor and interest accrual
  • Reserve accounting and debt mint / burn
  • Liquidation core execution and caps

Primary risks

  • Theft of user funds
  • Reserve insolvency
  • Undercollateralized borrowing
  • Blocked repayments, withdrawals, or liquidations

Program B - LP Collateral & Valuation

Covers the Avana-specific valuation system for LP-backed credit, including how LP positions are priced, risk-weighted, and stress-tested under volatile market conditions.

Highest sensitivity

Includes

  • LP token onboarding logic
  • Collateral factor assignment for LP positions
  • LP share pricing and oracle integration
  • Concentrated liquidity position handling
  • Edge cases during imbalance, depegs, low liquidity, or stale oracle states

Primary risks

  • Overvaluation of LP collateral
  • Oracle manipulation enabling bad debt
  • Unfair liquidation from underpricing
  • Recursive exploit paths against mispriced LP collateral

Why it matters: Highest severity ceiling: LP mispricing can create bad debt, insolvency, or unfair liquidations without a classic contract drain.

Program C - Governance, Admin, and Protocol Infrastructure

Covers privileged control surfaces that can alter parameters, upgrade contracts, pause operations, or redirect protocol-owned assets.

Includes

  • Governance executor and timelock
  • Role management and upgradeability mechanisms
  • Pause / guardian roles
  • Parameter admin systems
  • Treasury, collector, and privileged automation contracts

Primary risks

  • Unauthorized admin action
  • Upgrade hijack
  • Parameter corruption
  • Governance takeover or treasury loss

Program D - Offchain / Integration Surfaces

Covers supporting systems whose compromise can influence trusted protocol operations, user interactions, or keeper behavior.

Includes

  • Indexing or liquidation bots maintained by Avana
  • Keeper assumptions and oracle relays
  • SDK logic that can induce unsafe interactions
  • Hosted APIs used in safety-critical paths
  • Frontend issues with direct wallet-risk consequences

Primary risks

  • Malicious transaction construction
  • Compromised liquidation or oracle relay paths
  • User fund loss through trusted integrations
  • Operational outages that freeze critical actions

Subsystems are triaged separately, but impact is still scored across solvency, user fund safety, liquidation integrity, and related protocol risk.

Severity Philosophy

Generic vulnerability scores are not the main ranking method here. Findings are judged by credible exploit paths and by the economic outcome they can create.

Critical

Direct or indirect fund loss, creation of bad debt, protocol insolvency, or systemic manipulation of collateral valuation.

High

Meaningful but bounded damage, such as incorrect liquidation behavior, partial bypass of risk controls, or contained accounting failures.

Medium / Low

Limited-impact findings, edge-case inconsistencies, non-critical logic issues, or vulnerabilities without a credible path to major economic harm.

A bug that looks small in code can still be critical if it enables LP overvaluation or bad debt. A technically interesting issue can rank lower if it does not have a credible path to meaningful financial damage.