Daimo Pay

Rewards by Threat Level

Reward Calculation for Critical Level Reports

• For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 20 000.. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 10 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

Repeatable Attack Limitations

• If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward.
• The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [300 blocks] the attack needs for subsequent attacks from the first attack, rounded down.

Reward Calculation for High Level Reports

• High impacts concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 2500 to USD 7500. with the reward calculated based on 100% of the funds at risk, though capped at the maximum high reward.
• In the event of temporary freezing, the reward doubles from the full frozen value for every additional expirationTimestamp for a given Daimo Pay intent, that the funds are temporarily frozen, up until a max cap of the high reward.

The assets in scope for this bounty are specifically our Daimo Pay smart contracts.

Not in scope:

• Web app/SDK/JS issues. We are listing the test page (htts://pay.daimo.com/demo/tests) only as an aid for researchers to test and understand our contracts more quickly, not because we are looking for bugs in the test page itself.

Special case:

• 'DaimoPayRelayer'. This is an untrusted contract. Any issues that result in loss of user funds will be treated as critical, while issues resulting in loss of our own company funds in DaimoPayRelayer will be treated has high severity but not critical.