All smart contracts of Arbitrum can be found at [https://github.com/OffchainLabs/nitro-contracts](https://github.com/OffchainLabs/nitro-contracts)
[https://github.com/OffchainLabs/token-bridge-contracts](https://github.com/OffchainLabs/token-bridge-contracts)
[https://github.com/ArbitrumFoundation/governance](https://github.com/ArbitrumFoundation/governance), and
[https://github.com/OffchainLabs/fund-distribution-contracts](https://github.com/OffchainLabs/fund-distribution-contracts)

However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Assets should be evaluated according to the their public, mainnet deployments; their deployed addresses are listed on the following pages:
[
https://developer.arbitrum.io/useful-addresses](https://developer.arbitrum.io/useful-addresses)
[https://docs.arbitrum.foundation/deployment-addresses](https://docs.arbitrum.foundation/deployment-addresses)


Arbitrum is a suite of scaling solutions for Ethereum developed by Offchain Labs that drastically reduces costs and latency. Arbitrum One is an "Optimistic Rollup", which instantly scales apps, reducing costs and increasing capacity, without sacrificing Ethereum's security. Arbitrum validators optimistically post updates to Ethereum, and the protocol uses an interactive fraud proof mechanism to resolve any disputes efficiently with a minimal on-chain footprint.

Direct theft of any user funds, whether at-rest or in-motion

Permanent freezing of funds (cannot be fixed by upgrade)

Insolvency

Any inputs to the state transition function that trigger an unexpected result, and that affects the whole network, not limited to a single node (excluding RPC inputs)

Permanent freezing of funds (can be fixed by upgrade)

Bugs relating to reorgs

Damage relating to withdrawing funds via fast bridges

Denial of Service (DoS) Attacks that cause network-wide outages (attacks that only take down the RPC do not count)

Smart contract unable to operate due to lack of funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Smart contract fails to deliver promised returns, but doesn’t lose value

In addition to the versions of these smart contracts on GitHub, this bug bounty also covers the deployments of these contracts presently in use by the Arbitrum One and Arbitrum Nova networks to the extent that any vulnerability impacts said networks (e.g. if only Arbitrum One's deployment had out of date vulnerable code relating to the Data Availability Service which is not enabled on Arbitrum One and this made the vulnerability unusable to harm Arbitrum One, it would not be in scope). This bug bounty also covers any upgrades to those in scope deployments which have been scheduled by a passed on-chain constitutional DAO vote or the non-emergency security council multisig, as long as that action is currently waiting in the L2 governance timelock, the bridge to L1, or the L1 governance timelock (i.e. it has passed and is set to go through, and has not been canceled).


Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All bug reports must come with a PoC in order to be considered for a reward.

Critical bug reports are capped at 10% of economic damage, primarily considering the funds at risk, and taking into account branding and PR issues, at the discretion of the team. However, rewards for Critical bug reports have a minimum reward of __USD 50 000__.

Payouts are handled by the __Offchain Labs__ team directly and are denominated in USD. However, payouts are done in __USDC__.

Arbitrum

Resources & Documentation