All smart contracts of Connext can be found at [https://github.com/connext/monorepo/tree/main/packages/deployments/contracts/contracts](https://github.com/connext/monorepo/tree/main/packages/deployments/contracts/contracts). with recent deployments in the `deployments` directory. For similar contracts (multiple instances on different chains), there will not be duplicated counting of bugs. One bug that exists in all contracts will be counted as a single bug.

If a High or Critical impact can be caused to any other asset managed by Connext that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project.

Connext is a modular protocol for securely passing funds and data between chains. Developers can use Connext to build crosschain apps (__xApps__) - applications that interact with multiple domains (blockchains and/or rollups) simultaneously.

Network not being able to confirm new transactions (Total network shutdown)

Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

RPC API crash

Any governance voting result manipulation

Permanent freezing of funds

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Miner-extractable value (MEV)

Protocol Insolvency

Unintended chain split (Network partition)

Transient consensus failures

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

High compute consumption by validator/mining nodes

Attacks against thin clients

DoS of greater than 30% of validator or miner nodes and does not shut down the network

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

DoS of greater than 10% but less than 30% of validator or miner nodes and does not shut down the network

Underpricing transaction fees relative to computation time

Contract fails to deliver promised returns, but doesn't lose value

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All Critical smart contract bug reports must come with a detailed written explanation in order to be considered for a reward. 

Rewards for valid bug reports are paid at the dollar amount displayed in the rewards table or __10%__ of the USD value at risk, whichever of the two is less. 

Vulnerabilities marked in the following audits are not eligible for a reward.
  - [Consensys Diligence Audit ](https://consensys.net/diligence/audits/private/rrcm4t83gvyj6a/)
  - [https://github.com/connext/audits](https://github.com/connext/audits)

Payouts are handled by the __Connext__ team directly and are denominated in USD. However, payouts are done in __USDC__, __USDT__, __DAI__, with the choice of the ratio at the discretion of the team.