Only the main branch will be considered in scope. Any vulnerabilities affecting the main branch will be included in the scope. Only Solidity files (*.sol) will be considered in scope. All Solidity files (*.sol) which are used for tests are out of scope. When reporting a bug, please make sure to give the exact proxy and implementation of smart contracts which are currently running in use. Any not in use or obsolete smart contract implementations are out of scope.

However if you find a bug in a BendDAO smart contract outside of these repositories, where user funds are at risk, the team will consider the issue to be in-scope for our bounty.

Bend DAO is the first decentralized peer-to-pool based NFT liquidity protocol. Borrowers can borrow ETH instantly through the lending pool using NFTs as collateral. Depositors provide ETH liquidity to the lending pool to earn interest. 

Smart contract fails to deliver promised returns, but doesn’t lose value

Imprecision on accounting (balances, rates)

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of unclaimed yield of numerous users

Permanent freezing of unclaimed yield of numerous users

Direct theft of individual user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds of individual user

Smart contract unable to operate and call ( e.g. destruct of code, lack of funds)

Theft of unclaimed yield of individual user

Permanent freezing of unclaimed yield of individual user

Manipulation of interest rates (supply or borrow) with mechanisms not intended or limited by design

Direct theft of numerous user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds of numerous user

Insolvency

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All Smart Contract bug reports require a PoC and a suggestion for a fix to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.

Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. 

All vulnerabilities marked in the [Security Audit Reports](https://docs.benddao.xyz/portal/security-and-risks/audits) are not eligible for a reward. 

Payouts are handled by the __BendDAO__ team directly and are denominated in USD. However, payouts are done in __BEND__.