All smart contracts of Connext can be found at [https://github.com/connext/monorepo/tree/main/packages/deployments/contracts/contracts](https://github.com/connext/monorepo/tree/main/packages/deployments/contracts/contracts). with recent deployments in the `deployments` directory. For similar contracts (multiple instances on different chains), there will not be duplicated counting of bugs. One bug that exists in all contracts will be counted as a single bug.

If a High or Critical impact can be caused to any other asset managed by Connext that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project.

Connext is a modular protocol for securely passing funds and data between chains. Developers can use Connext to build crosschain apps (__xApps__) - applications that interact with multiple domains (blockchains and/or rollups) simultaneously.

Unintended chain split (network partition)

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Network not being able to confirm new transactions (total network shutdown)

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

Permanent freezing of funds

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Protocol insolvency

Any governance voting result manipulation

Miner-extractable value (MEV)

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All Critical smart contract bug reports must come with a detailed written explanation in order to be considered for a reward. 

Rewards for valid bug reports are paid at the dollar amount displayed in the rewards table or __10%__ of the USD value at risk, whichever of the two is less. 

Vulnerabilities marked in the following audits are not eligible for a reward.
  - [Consensys Diligence Audit ](https://consensys.net/diligence/audits/private/rrcm4t83gvyj6a/)
  - [https://github.com/connext/audits](https://github.com/connext/audits)

Payouts are handled by the __Connext__ team directly and are denominated in USD. However, payouts are done in __USDC__, __USDT__, __DAI__, with the choice of the ratio at the discretion of the team.