Daimo Pay is a intent-based system for crypto payments. In particular, it supports fast 1:1 transfers from any major stablecoin across chains.

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Temporary freezing of funds

Contract fails to deliver promised returns, but doesn't lose value

Daimo Pay

__Rewards by Threat Level__

__Reward Calculation for Critical Level Reports__

- For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 20 000.. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 10 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

__Repeatable Attack Limitations__

- If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward.
- The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [300 blocks] the attack needs for subsequent attacks from the first attack, rounded down.

__Reward Calculation for High Level Reports__

- High impacts concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 2500 to USD 7500. with the reward calculated based on 100% of the funds at risk, though capped at the maximum high reward.
- In the event of temporary freezing, the reward doubles from the full frozen value for every additional expirationTimestamp for a given Daimo Pay intent, that the funds are temporarily frozen, up until a max cap of the high reward.

The assets in scope for this bounty are specifically our Daimo Pay smart contracts.

Not in scope:
* Web app/SDK/JS issues. We are listing the test page (htts://pay.daimo.com/demo/tests) only as an aid for researchers to test and understand our contracts more quickly, not because we are looking for bugs in the test page itself.

Special case:
* 'DaimoPayRelayer'. This is an untrusted contract. Any issues that result in loss of *user* funds will be treated as critical, while issues resulting in loss of our own *company* funds in DaimoPayRelayer will be treated has high severity but not critical.

Daimo Pay

Codebase

Documentation