Metastreet Yield Pass

Rewards by Threat Level

Reward Calculation for Critical Level Reports

For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD $50,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD $15,000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

Repeatable Attack Limitations

• If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward.
• The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [14400 blocks] the attack needs for subsequent attacks from the first attack, rounded down

Reward Calculation for High Level Reports

• High impacts concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of $3,000 to $15,000 with the reward calculated based on 100% of the funds at risk, though capped at the maximum high reward.
• In the event of temporary freezing, the reward doubles from the full frozen value for every additional 24h that the funds are temporarily frozen, up until a max cap of the high reward.