Carbon DeFi by Bancor

The following are not within the scope of the Program:

• Bugs in any third party contract or platform that interacts with Carbon Defi.
• Vulnerabilities already reported and/or discovered in contracts built by third parties on Carbon Defi. We reserve the right to keep private previous bug disclosures.
• Any previously reported bugs.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage.
• Attacks requiring access to leaked keys/credentials.
• Attacks requiring access to privileged addresses (governance, strategist)
• Incorrect data supplied by third party oracles (Note that oracle manipulation and flash loan attacks are included in the bounty)
• Basic economic governance attacks (e.g. 51% attack)
• Best practice critiques
• Sybil attacks
• Bugs in any third party contract or platform that interacts with the Carbon Defi protocol (Note that oracle manipulation and flash loan attacks are included in the bounty)

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets or private mainnet forks
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against contributors and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty

Other Terms

By submitting your report, you grant the Bprotocol Foundation any and all rights, including intellectual property rights, needed to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility for and amounts of the rewards and the manner in which such rewards will be paid, are made at the sole discretion of the Bprotocol Foundation. The terms and conditions of the Carbon Defi Bug Bounty Program may be altered at any time. The above scope, terms and rewards of the program are at the sole discretion of the Bprotocol Foundation.