Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Payouts are handled by __xDai__ team directly and are denominated in __USD__. However, payouts are done in __USDT__. Payouts above USDT $100,000 are completed in __STAKE__.

Only contracts that are active are considered within the scope of this program.  If a contract is listed as deprecated, it is not considered as in-scope of the bug bounty program. 

Only web/app vulnerabilities that **directly** affect the web/app assets in this table are accepted within the bug bounty program. All others are out-of-scope.

Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

The final reward for critical smart contract and blockchain bounty payouts 
is capped at 10% of the funds at risk based on the vulnerability 
reported. However, they have a minimum payout of **USD 50 000**.

The only web vulnerabilities in scope are those which lead **directly** and 
unequivocally to loss of user funds, a direct breach of data, and the deletion 
of site data.

Payouts are handled by the **Cream Finance** team directly and are denominated 
in **USD**. Payouts are done in **USDC** or **DAI** for payouts equal to or less 
than **USD 50 000**. When payouts are over USD 50 000 but less than USD 1 250 000, 
up to 80% of the payout will be in **CREAM** with the rest in **USDC** or **DAI**. 
For payments above USD 1 250 000, the remainder is paid in $ARMOR by the ArmorFi 
team under the **Armor Alliance Bug Bounty Challenge** with a vesting period of up 
to 24 months.

As noted in the Delta repository, only smart contracts with the `// DELTA-BUG-BOUNTY` comment are included in the program.

Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

The final reward amount for critical smart contract and blockchain vulnerabilities is capped at 10% of the funds at risk based on the vulnerability reported.

The likelihood of exploitability is also taken into consideration in the
determination of the final payout amount based on the severity of the bug
reported according to the table below:

| | Low | Medium | High | Critical |
| :-- | :-- | :-- | :-- | :-: |
| Almost Certain | $2,000 | $10,000 | $25,000 | $1,500,000 |
| Likely | $1,000 | $5,000 | $10,000 | $25,000 | 
| Possible | $500 | $1,000 | $5,000 | $10,000 |
| Unlikely  | $200 | $750 | $2,000 | $5,000 |
| Almost Possible | $200 | $500 | $1,000 | $3,500 |

In addition to the Immunefi Vulnerability Severity Classification System, the
following information is provided by the Delta team for further
clarity. Whenever there is a conflict between these two, the information
provided by the Delta team here will prevail.

**Critical**

- Minting bug on tokens (Anything that gives you more tokens than you should
  have, creating tokens out of air)
- Liquidity removal under any conditions
- Abusing and stealing funds from the Deep Farming Vault (if it can be done on
  a mass scale)
- Raising the price with rebasing

**High or Medium** (depending on exploitability and impact)

- Deep Farming Vault inefficiencies - bugs reported need to have a write up
  that explains how it happens or an EVM proof in our suite of tests (hardhat)
  - Exploits that could benefit individuals “in-the-know”

**Low**

- Increasing volume generated by the rebasing LP (rebasing LP contract)

**Special Reward: Gas improvements**

A special reward of up to $2,000 for gas improvements is provided. Prove and
explain why calls could use less gas. The priority is the Delta token and the
most incentivized is the Delta token. After that in priority is the deep
farming vault. Gas usage is not a priority in other contracts - safety is.

Payouts are handled by **Delta** team directly and are denominated in
**USD**. All payouts are done in **ETH**. This bug bounty program has a maximum
cumulative amount of $2MM worth of Ethereum for all bug/vulnerability findings.

As with all bug reports submitted on Immunefi, bug reports are handled on a
first-come-first-serve basis.

A full list of the smart contracts of SushiSwap can be found in their [Github repository](https://github.com/sushiswap). However, only the contracts listed in this table are considered as within the scope of the bug bounty program.

Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Theft of Yield vulnerability reports are temporarily not in scope for this bug bounty program, though this attack may be in the future.

All web/app bug reports must come with a PoC. All bug reports without a PoC will not be accepted under this bug bounty program.

All critical payments, both for smart contracts and the website, are capped at 
10% of economic damage. The only web vulnerabilities in scope are those which 
lead directly and unequivocally to loss of user funds, such as by spoofing 
transactions on the Sushi interface.

Sushiswap is open to rewarding bounties beyond the critical cap for
vulnerabilities with extreme impact.

Payouts are handled by the **SushiSwap** team directly and are denominated in **USD**. Payouts worth USD $100,000 and below are done in **USDC**. Payouts beyond USD $100,000 up to USD 1,000,000 are made in **SUSHI**, though the first $100,000 can be made in **USDC** if requested.  Payouts above USD 1,000,000 have the remainder paid in __ARMOR__ under the Armor Alliance Bug Bounty Challenge with a vesting period of up to 24 months. 


Rewards are distributed according to the impact of the vulnerability based on
the <Link href="/severity-system/">Immunefi Vulnerability Severity Classification System</Link>. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

The following smart contract issues are known and reports including these vulnerabilities are not considered to be in scope of this bug bounty program and will not receive a reward:

- FEI can be wrapped to avoid burn
- Supplying LP incurs a burn and withdrawing earns a mint just like trading
- Supplying LP before a reweight can increase PCV expense to Fei Protocol
- Reweights can be dust attacked by repeated buying
- Reweights can be front and back-run
- The burn penalty over-penalizes by factoring the burn amount into price impact

All web and app bug reports must include a PoC in order for consideration 
of a reward. Web and app bug reports without a PoC will be rejected with 
instructions to provide one.

Critical-level smart contract vulnerabilities that result in the loss of user 
funds will have rewards additionally capped at 10% of the funds potentially 
affected based on the vulnerability that was identified. These rewards are 
additionally only payable in **TRIBE** and have a vesting schedule lasting between 6-12 months with a minimum of 6 months for rewards up to USD 400 000, with an additional month added for every USD 100 000 tranche, rounded up. 

Payouts are handled by the **Fei Protocol** team directly and are denominated
in **USD**. However, payouts are done in **TRIBE** or **FEI**. For Low and
Medium threat levels, payouts can alternatively be in **ETH** or **USDC**.

DeFi's leading bug bounty platform, protecting $25 billion in user funds

For Hackers

For Projects