At ALEX, we build DeFi primitives targeting developers looking to build ecosystem on Bitcoin, enabled by Stacks. As such, we focus on trading, lending and borrowing of crypto assets with Bitcoin as the settlement layer and Stacks as the smart contract layer.

Theft of unclaimed yield

Freezing of unclaimed yield

Temporary freezing of funds for a minimum period of 1 day

Loss of user funds staked (principal) by freezing or theft

Vote manipulation

Miner-extractable value (MEV)

Protocol insolvency

Permanent freezing of funds

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All High and Critical Smart Contract bug reports require a PoC in order to be considered for a reward.  Explanations and statements are not accepted as PoC and code is required. 

Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of __USD 20 000__ paid in __ALEX__. Additionally, the maximum reward is capped at __USD 100 000)__ paid in __ALEX__, even if 10% of the damage in USD equivalent is greater than the __USD 100 000__. 

The following vulnerabilities are not eligible for a reward:

  - All vulnerabilities marked in the CoinFabrik Security Review [Pool / Equation](https://cdn.alexlab.co/pdf/AlexGo_Audit_202111_Pool_Equation.pdf), [Launchpad / Vault / Reserve](https://cdn.alexlab.co/pdf/AlexGo_Audit_202201_Launchpad_Vault_Reserve.pdf)
  - All vulnerabilities marked in the CoinFabrik Security Review [DAO](https://cdn.alexlab.co/pdf/AlexGo_Audit_202202_DAO.pdf)
  - All vulnerabilities marked in the CoinFabrik Security Review [Launchpad v1.1 / AutoALEX / Collateral Rebalancing Pool](https://cdn.alexlab.co/pdf/AlexGo_Audit_202204_Launchpadv1.1_AutoALEX_CRP.pdf)
  - All vulnerabilities marked in the CoinFabrik Security Review [Bridge Endpoints](https://cdn.alexlab.co/pdf/ALEX_Audit_bridge_coinfabrik_202212.pdf)
  - All vulnerabilities marked in the CoinFabrik Security Review [Bridge backend and endpoints](https://cdn.alexlab.co/pdf/ALEX_Audit_Bridge_2023-04.pdf)
  - All vulnerabilities marked in the [Least Authority Security Review](https://cdn.alexlab.co/pdf/Least_Authority_ALEX_Protocol_Smart_Contracts_Final_Audit_Report.pdf) 

ALEX requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed are Name, Email address, Stacks wallet address, and Identity Proof (Passport, / Driving License / National ID). The collection of this information will be done by the ALEX team.

Payouts are handled by the __ALEX__ team directly. Payouts are done in __ALEX__.