Vana (VanaPool)

The risk rating methodology used by Nethermind Security follows the principles established by the OWASP Foundation. The severity of each finding is determined by two factors: Likelihood and Impact.

Likelihood measures how likely the finding is to be uncovered and exploited by an attacker. This factor will be one of the following values:

1. High: the issue is trivial to exploit and has no specific conditions that need to be met;
2. Medium: the issue is moderately complex and may have some conditions that need to be met;
3. Low: the issue is very complex and requires very specific conditions to be met.

When defining the likelihood of a finding, other factors are also considered. These can include but are not limited to motive, opportunity, exploit accessibility, ease of discovery, and ease of exploit.

Impact is a measure of the damage that may be caused if an attacker exploits the finding. This factor will be one of the following values:

1. High: the issue can cause significant damage, such as loss of funds or the protocol entering an unrecoverable state;
2. Medium: the issue can cause moderate damage, such as impacts that only affect a small group of users or only a particular part of the protocol;
3. Low: the issue can cause little to no damage, such as bugs that are easily recoverable or cause unexpected interactions that cause minor inconveniences.

When defining the impact of a finding, other factors are also considered. These can include but are not limited to data and state integrity, loss of availability, financial loss, and reputation damage. After defining the likelihood and impact of an issue, the severity is determined according to the table below.

To address issues that do not fit a High, Medium or Low severity, Nethermind Security also uses three more finding severities: Informational, Best Practices, and Undetermined.

1. Informational findings do not pose any risk to the application, but they carry some information that the audit team intends to pass to the client formally;
2. Best Practice findings are used when some piece of code does not conform with smart contract development best practices;
3. Undetermined findings are used when we cannot predict the impact or likelihood of the issue.