Only the main branch will be considered in scope. Any vulnerabilities affecting the main branch will be included in the scope. Only Solidity files (*.sol) will be considered in scope. All Solidity files (*.sol) which are used for tests are out of scope. When reporting a bug, please make sure to give the exact proxy and implementation of smart contracts which are currently running in use. Any not in use or obsolete smart contract implementations are out of scope.

However if you find a bug in a BendDAO smart contract outside of these repositories, where user funds are at risk, the team will consider the issue to be in-scope for our bounty.

Bend DAO is the first decentralized peer-to-pool based NFT liquidity protocol. Borrowers can borrow ETH instantly through the lending pool using NFTs as collateral. Depositors provide ETH liquidity to the lending pool to earn interest. 

Direct theft of numerous user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds of numerous user

Insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Direct theft of individual user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds of individual user

Smart contract unable to operate and call ( e.g. destruct of code, lack of funds)

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Issues that the risk is relatively small and does not pose a threat to user funds.

Smart contract fails to deliver promised returns, but doesn’t lose value

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All Smart Contract bug reports require a PoC and a suggestion for a fix to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.

Critical smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. 

All vulnerabilities marked in the [Security Audit Reports](https://docs.benddao.xyz/portal/risk/security-and-audits#audits) are not eligible for a reward. 

Payouts are handled by the __BendDAO__ team directly and are denominated in USD. However, payouts are done in __BEND__.

BendDAO

Resources & Documentation