Matic Layer2 Smart Contract Security

Matic Layer2 Smart Contract Security

Matic Network is a layer2 platform which aims to provide a generalized Layer2 platform to provide various layer2 execution environments to Dapp Developers on top of Ethereum. Being a layer2, Matic Network staking, validation, staking reward distribution and slashing happens on Ethereum Mainnet. Matic Layer2 Security hackathon is designed to promote expert smart contract developers to have a close look and hunt for critical bugs.

The hackathon provides opportunity for the developers to delve deep into the nuances of building a secure layer2 platform and explore ways to break staking and plasma smart contracts. Prizes will be paid out on an ongoing basis.

Prizes and judging criteria

There are four tiers of prize ranges. Each bounty submission could be eligible for any one of the prize tiers.

In addition, for this competition, the Matic team will apply a bounty multiplier ratio between 1 and 10, which can make the final payout up to $50,000. This multiplier ratio will be decided at the sole discretion of the Matic team.

Judging criteria will take into consideration:

• The criticality of the exploits (e.g., users/cases impacted, size of impact)
• How easy/complex it is to recreate
• Level of research and analysis that was done by the reporter

Please note that the prizes will be paid in Matic tokens and the USD value of prizes could change based on the rate.

Submission process and guidelines

Exploits:

1. Give us a heads up by clicking ‘Start work’ button on the Gitcoin posting for the bounty
2. Submit the evidence of your work by opening a new issue on Hacker One Page (https://hackerone.com/matic-network/). Once you're done with the Submission on Hacker One, make sure to click ‘Submit work’ and link your work on Gitcoin.
3. Make sure you add a link of your Hacker One submission in your Gitcoin work to easily identify your submission.
4. Wait up to 12 hours until our team tags your submission as valid. Please stay in contact with our team in case of additional requests.
5. After a submission is tagged as valid, any further similar submissions will not be eligible for prizes. It is in participant's responsibility to track other valid submissions (note that 'valid' tag does not guarantee rewards)
6. You will receive the final decision of winners within 2 months after the competition ends.
7. All rewards will be distributed via Hacker One website.

What are the bounties?

Exploits: These bounties help us identify vulnerabilities in our design and code, especially in our staking and delegation related smart contracts. The goal is to find attack vectors by which an attack can either lead to partial theft of funds or draining of funds from the contract. There may be more attack vectors too, we have just added indicative ones.

Scope for reference:

Staking: https://docs.matic.network/docs/contribute/contracts/stakingmanager

Delegation: https://docs.matic.network/docs/contribute/contracts/delegation

Code: https://github.com/maticnetwork/contracts/tree/release-0.3/contracts/staking

Root chain contract (for checkpoints): https://docs.matic.network/docs/contribute/heimdall/checkpoint

Code: https://github.com/maticnetwork/contracts/blob/release-0.3/contracts/root/RootChain.sol

Note that all Plasma contracts are Out of Scope for this hackathon.

Details of contracts deployed on Goerli: https://static.matic.network/network/testnet/mumbai/index.json

(see Main->Contracts key for reference)

Important Contract Addresses:

Rootchain: https://goerli.etherscan.io/address/0xCe29AEdCdBeef0b05066316013253beACa7A6268#code 

RootchainProxy: https://goerli.etherscan.io/address/0x2890bA17EfE978480615e330ecB65333b880928e#code 

StakeManager: https://goerli.etherscan.io/address/0xb36b6963f68dde1312a9e959817e35ff6b0f0aa9#code 

Stakemanager proxy: https://goerli.etherscan.io/address/0x00200ea4ee292e253e6ca07dba5edc07c8aa37a3#code 

ValidatorShare: https://goerli.etherscan.io/address/0xb6d4B5893729601759be67ed98896EF928e5EC88#code

Setting up Local environment:

https://github.com/maticnetwork/contracts/blob/release-0.3/README.md

Reach out to us for any queries:

If you have any questions, please join our Discord Channel and post your queries in the Developers->contracts channel: https://discord.gg/ujFqsjK