Only the web/app assets explicitly listed here are in-scope. All else is out-of-scope.

Relevant smart contracts of Polygon can be found at:

[https://github.com/maticnetwork/contracts](https://github.com/maticnetwork/contracts)

[https://github.com/maticnetwork/pos-portal](https://github.com/maticnetwork/contracts)

[https://github.com/fx-portal/contracts](https://github.com/maticnetwork/contracts)

[https://github.com/maticnetwork/genesis-contracts](https://github.com/maticnetwork/genesis-contracts) 

However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

__Impacts in Scope__

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

__Smart Contracts__

  - Loss of user funds by permanent freezing or direct theft
  - Loss of governance funds
  - Theft of unclaimed yield
  - Freezing of unclaimed yield
  - Temporary freezing of funds for any amount of time
  - Unable to call smart contract
  - Network shutdown
  - Smart contract gas drainage
  - Smart contract fails to deliver promised returns
  - Checkpoint manipulation
  - Protection of Delegated and Staked Amount on Smart Contract
  - Securing Bridge Transfers (Minting, Withdrawal)
  - Double spend by getting the clients to accept a different chain
  - Double spend by validating malicious blocks
  - Tamper/manipulate blockchain history to invalidate transactions
  - Cause a user to mint tokens to own account
  - Undermine consensus mechanism to split the chain
  - Censorship (e.g. on checkpoints)
  - Steal tokens from node
  - Prevent node from accessing the network
  - Abuse bugs in the economic system to defraud other participants (e.g. avoid transaction fees to full nodes)
  - Denial of service attacks
  - Chain halt and shutting down the network 

__Web/App__

  - Domain takeover
  - Denial of service
  - Access on server
  - Users spoofing other users
  - Redirected funds by address modification

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System](https://immunefi.com/severity-updated/). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

A PoC and a suggestion for a fix is required for all Critical and High bug reports. Additionally, a PoC is required for Medium Web/App bug reports. A high-quality suggestion for a fix may come with a bonus from the Polygon team.

All bug reports must include the following information in order to be considered for a reward:

Summary:
  - add summary of the vulnerability

Steps To Reproduce:
  - add details for how we can reproduce the issue

  1.  add step
  1.  add step
  1.  add step

Supporting Material/References:
 - list any additional material (e.g. screenshots, logs, etc.)
    - attachment / reference

Bug reports containing the following will not be eligible for a reward with this bug bounty program:

  - Previously known vulnerabilities (resolved or not) on the Ethereum network (and any other fork of these).
  - Previously known vulnerabilities in Tendermint and or/any other fork of these.
  - Previously known vulnerabilities in cosmos-sdk and or/any other fork of these.
  - Previously known vulnerable libraries without a working Proof of Concept.
  - Attacks requiring MITM or physical access to a user's device.
  - Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.

Critical Smart Contract bug reports are further capped at 10% of economic damage, which primarily takes into consideration the funds at risk but may include branding and PR aspects at the discretion of the team. However, they have a minimum reward of __USD 100 000__. 

Payouts are handled by the __Polygon__ team directly and are denominated in USD. However, payouts are done in __ETH__, __MATIC__, or a stablecoin, at the discretion of the Polygon team.

Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Payouts are handled by __xDai__ team directly and are denominated in __USD__. However, payouts are done in __USDT__. Payouts above USDT $100,000 are completed in __STAKE__.

Further information about the smart contracts in Sifchain can be found at [https://github.com/Sifchain/sifnode/tree/master/smart-contracts](https://github.com/Sifchain/sifnode/tree/master/smart-contracts). However, only those in the assets in scope table are considered as in-scope of the bug bounty program. 

Further information about the Web/App can be found at [https://github.com/sifchain/sifchain-ui](https://github.com/sifchain/sifchain-ui). Additionally, all other web/app components of the project are out-of-scope for this bug bounty program. 

Web/App vulnerabilities not directly involving the assets listed in this table are out of scope. 

__Impacts in Scope__

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

__Smart Contracts and Blockchain__

  - Loss of any funds by freezing or theft
  - Gaining unauthorized permissions or access to privileged roles
  - Any crashing or loss of availability of our blockchain

__Web/App__

  - Direct loss of any funds by freezing or theft
  - Gaining unauthorized permissions or access to privileged roles
  - Any crashing or loss of availability of our blockchain

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System](https://immunefi.com/severity-updated/). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. 

All web/app bug reports must come with a PoC in order to be considered for a reward. A PoC is not required for smart contract and blockchain vulnerabilities. However, one may be requested if validity is questioned. 

For both Smart Contract and web/app bugs, only those that are explicitly within the Impacts in Scope section are considered as in-scope of the bug bounty program. Additionally, for added clarification, the following vulnerabilities are explicitly out-of-scope in the bug bounty program:

  - Anything involving DDoS
  - Anything involving third party distributed system dependencies, especially various open source IBC relayer nodes, and overloading/crashing them
  -  Previously known vulnerabilities (resolved or not) on the Ethereum network (and any other fork of these).
  - Previously known vulnerabilities in Tendermint and or/any other fork of these.
  - Previously known vulnerabilities in Cosmos SDK and or/any other fork of these.
  - Previously known vulnerable libraries without a working Proof of Concept.
  - Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
  - Findings related to the encryption or access control of the third party wallets.

The maximum payout for a “Critical” bounty is 10% of the total value locked of the program, estimated at a maximum payout of __USD 1 920 000__ at the time this program was last updated, but with a minimum payout of __USD 50 000__. This page will update periodically to reflect changes in TVL. [Click here](http://dex.sifchain.finance) to view the most up-to-date TVL.

Payouts are handled by the __Sifchain__ team directly and are denominated in USD. However, payouts are done in __USDT__, __USDC__, __ETH__, or __BTC__, at the discretion of the team.

Additionally, all smart contract source codes can be found at [https://etherscan.io/address/0xc803737D3E12CC4034Dde0B2457684322100Ac38#code](https://etherscan.io/address/0xc803737D3E12CC4034Dde0B2457684322100Ac38#code). 
However, only those in the table are considered as in-scope of the bug bounty program. 

All issues found in [this document](https://docs.google.com/document/d/1dOELO8Jq_IZPI0hA352CIdiqFNiSTD_mpf_NDmXcANE/edit?usp=sharing) are considered as out-of-scope of this bug bounty program.

For further reference, the relevant GitHub can be found at [https://github.com/Tokemak/tokemak-smart-contracts-public/tree/main](https://github.com/Tokemak/tokemak-smart-contracts-public/tree/main). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

__Impacts in Scope__

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

__Smart Contracts__

  - Direct theft or permanent freezing of staked funds in Tokemak contracts (Critical)
    - (this item currently excludes capital deployed into other protocols)
  - Theft of unclaimed yield (High)
  - Freezing of staked funds in Tokemak contracts for more than 10 minutes (High)
    - (excludes filling blocks so Manager contract unable to rollover cycles)
  - Freezing of unclaimed yield for a period of more than 10 minutes (High)

__Web/App__

  - Redirected funds by address modification (Critical)
  - Users spoofing other users leading to loss of user funds (Critical)

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System](https://immunefi.com/severity-updated/). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All bug reports, with the exception of Low smart contract bugs, are required to come with a PoC. A suggestion for a fix is also required for all severity levels. 

Critical smart contract vulnerabilities are further capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and marketing considerations, at the discretion of the team. However, there is a minimum reward of __USD 50 000__.

Payouts are handled by the __Tokemak__ team directly and are denominated in USD. However, payouts are done in __ETH__, __TOKE__, or stablecoins, at the discretion of the team.

DeFi's leading bug bounty platform, protecting $50 billion in user funds

For Hackers

For Projects