Bug Bounty
Responsible disclosure scope and economic-impact triage guidance for Avana security research.
Overview
The Avana Bug Bounty covers responsible disclosure across contracts, risk systems, and supporting infrastructure that can affect user funds or protocol solvency. The scope includes direct contract vulnerabilities and economic failures involving LP collateral. Manipulated prices, insufficient liquidity, or inconsistent position state can affect borrowing capacity or prevent liquidation from recovering debt. Severity is based on economic impact: assessment considers exploitability and outcomes such as fund loss, insolvency, bad debt, or systemic collateral mispricing. The size of the affected code is not a measure of the potential loss.
Scope & System Architecture
Reports are grouped by the affected subsystem: core lending, LP valuation, governance and administration, or offchain integrations. The grouping identifies the component involved; severity depends on the demonstrated impact.
Program A - Core Lending
Covers the primary credit engine where accounting integrity, collateralization, and liquidation execution directly protect user funds.
Includes
- Deposit / withdraw flows
- Borrow / repay logic
- Health factor and interest accrual
- Reserve accounting and debt mint / burn
- Liquidation core execution and caps
Primary risks
- Theft of user funds
- Reserve insolvency
- Undercollateralized borrowing
- Blocked repayments, withdrawals, or liquidations
Program B - LP Collateral & Valuation
Covers the Avana-specific valuation system for LP-backed credit, including how LP positions are priced, risk-weighted, and stress-tested under volatile market conditions.
Includes
- LP token onboarding logic
- Collateral factor assignment for LP positions
- LP share pricing and oracle integration
- Concentrated liquidity position handling
- Edge cases during imbalance, depegs, low liquidity, or stale oracle states
Primary risks
- Overvaluation of LP collateral
- Oracle manipulation enabling bad debt
- Unfair liquidation from underpricing
- Recursive exploit paths against mispriced LP collateral
Why it matters: LP mispricing can have critical economic impact by enabling bad debt, insolvency, or incorrect liquidations, even without direct theft from a contract.
Program C - Governance, Admin, and Protocol Infrastructure
Covers privileged control surfaces that can alter parameters, upgrade contracts, pause operations, or redirect protocol-owned assets.
Includes
- Governance executor and timelock
- Role management and upgradeability mechanisms
- Pause / guardian roles
- Parameter admin systems
- Treasury, collector, and privileged automation contracts
Primary risks
- Unauthorized admin action
- Upgrade hijack
- Parameter corruption
- Governance takeover or treasury loss
Program D - Offchain / Integration Surfaces
Covers supporting systems whose compromise can influence trusted protocol operations, user interactions, or keeper behavior.
Includes
- Indexing or liquidation bots maintained by Avana
- Keeper assumptions and oracle relays
- SDK logic that can induce unsafe interactions
- Hosted APIs used in safety-critical paths
- Frontend issues with direct wallet-risk consequences
Primary risks
- Malicious transaction construction
- Compromised liquidation or oracle relay paths
- User fund loss through trusted integrations
- Operational outages that freeze critical actions
Subsystems are triaged separately, but impact is still scored across solvency, user fund safety, liquidation integrity, and related protocol risk.
Severity Philosophy
Severity assessment considers a credible exploit path and the economic harm it could cause, rather than relying only on a generic vulnerability score.
Critical
Direct or indirect fund loss, creation of bad debt, protocol insolvency, or systemic manipulation of collateral valuation.
High
Meaningful but bounded damage, such as incorrect liquidation behavior, partial bypass of risk controls, or contained accounting failures.
Medium / Low
Limited-impact findings, edge-case inconsistencies, non-critical logic issues, or vulnerabilities without a credible path to major economic harm.
A finding that enables LP overvaluation or bad debt can be critical even if it affects little code. Findings without a credible path to significant economic harm receive a lower severity assessment.