All code of  Buttonwood can be found at [https://github.com/buttonwood-protocol](https://github.com/buttonwood-protocol). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Once deployed on mainnet, the smart contract addresses can be found at [https://docs.prl.one/buttonwood/developers/deployed-contracts/ethereum-mainnet](https://docs.prl.one/buttonwood/developers/deployed-contracts/ethereum-mainnet).

Only files in the parent "contracts" folder for both of the assets listed in this table are in scope.


Buttonwood is a DeFi project creating and implementing various DeFi protocols, including liquidity aggregation, price-stabilization wrappers, governance, peer-to-peer lending, and risk stratification.

Loss of user funds staked (principal) by freezing or theft

Protocol Insolvency

Any governance voting result manipulation

Theft of funds in excess of gas costs or swap fees

Permanent freezing of funds (dependent on the value at stake)

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Unbounded gas consumption

Temporary freezing of funds (dependent on the value at stake)

Permanent freezing of unclaimed yield

Theft of unclaimed yield

Contract fails to deliver promised returns, but doesn't lose value

__Informational__
  - Best practice critiques


Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. 

Critical smart contract bug reports are further capped at 10% of economic damage, primarily taking into consideration the funds at risk, but also considering other aspects such as PR and branding considerations, at the discretion of the team. However, there is a minimum reward of __USD 100 000__.

Bug reports of other severity levels will take into consideration the exploitability and impact of the bug reports had they been executed. Buttonwood reserves the right to make the final decision on the reward amount.

Payouts are handled by the __Buttonwood__ team directly and are denominated in USD. However, payouts are done in  __ETH__ or __USDC__, at the discretion of the team.

Buttonwood

Resources & Documentation