Autonolas

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

Critical Smart Contract vulnerabilities are rewarded at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team, capped at USD 5 000. High Smart Contract vulnerabilities are rewarded at up to USD 2 000. Medium Smart Contract vulnerabilities are rewarded at up to USD 1 000. Low Smart Contract vulnerabilities are not in scope for this program.

All Critical, High, and Medium Smart Contract bug reports must come with a PoC, have an end-effect impact, and an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

The following vulnerabilities are not eligible for a reward:

• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/audits
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/docs
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-governance/tree/main/test
• All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-governance/tree/v1.2.5-post-external-audit/contracts
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/audits
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/docs
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-registries/tree/main/test
• All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-registries/tree/v1.3.3-post-external-audit/contracts
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/audits
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/docs
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-tokenomics/tree/main/test
• All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-tokenomics/tree/v1.4.3/contracts
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-marketplace/tree/main/audits
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-marketplace/tree/main/docs
• All vulnerabilities mentioned in https://github.com/valory-xyz/autonolas-marketplace/tree/main/test
• All vulnerabilities mentioned in the comments on the contracts code https://github.com/valory-xyz/autonolas-marketplace/tree/v0.4.2/contracts
• All vulnerabilities that arise from misconfigured registration from users (e.g. component owners, agent owners, service owners, agent operators) or misuse of the registration logic (e.g. accidental locking of funds, loss of keys to control services, etc.).

Note on inherited and integrated third-party code: all external code is in scope where it is incorporated into or integrated with Olas's own contracts. The comprehensive list of in-scope external sources is:

• Inherited library code: OpenZeppelin (@openzeppelin/contracts and @openzeppelin/contracts-upgradeable), Solmate, Safe-Ecosystem safe-contracts (@gnosis.pm/safe-contracts), the Gnosis Mech base contract (gnosis-mech, used by the marketplace OlasMech), the Curve Finance VotingEscrow (ported into veOLAS), Uniswap V2 (@uniswap/v2-core and @uniswap/v2-periphery), Jeiwan zuniswapv2, and Polygon fx-portal.
• Integrated protocol / bridge infrastructure: Wormhole (wormhole-solidity-sdk and the L1/L2 transceivers), the OP-Stack CrossDomainMessenger (Optimism, Base, Celo, Mode), Polygon FxPortal, the Gnosis AMB / OmniBridge, the Arbitrum / Optimism / Base bridge contracts that the deposit processors call into, and the Balancer V2 Vault (queried by BalancerPriceOracle).

Issues reported against any of these sources will be assessed on the basis of their concrete impact on the in-scope Olas contracts. The Nevermined subscription condition contracts are not covered because the only Olas-side integration with them, SubscriptionProvider, is itself out of scope.

Autonolas requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an invoice with Name, Address, and Country of the hacker or a legal entity used for transactions. If the hacker is based in Switzerland they need to account for VAT in the invoice. The collection of this information will be done by the Valory team.

Payouts are handled by the Valory team directly and are denominated in USD. However, payouts are done in USDT and USDC, with the choice of the ratio at the discretion of the team.