All smart contracts of dHEDGE can be found at [https://github.com/dhedge/V2-Public](https://github.com/dhedge/V2-Public). dHEDGE deployed contracts that are currently linked to the Pool Factory are considered in scope, including other chains such as Optimism.

dHEDGE is a one-stop location for managing investment activities on the blockchain where you can put your capital to work in different strategies based on a transparent track record. Multi-chain, non-custodial, decentralized asset management integrated with multiple protocols; allowing for trades, providing liquidity and yield farming.

Permanent loss or freezing of funds

Permanent loss or freezing of funds $10m+ (Possible)

Permanent loss or freezing of funds $100k+ (Very Likely)

Permanent loss or freezing of funds $10m+ (Very Unlikely)

Permanent loss or freezing of funds $1m+ (Unlikely)

Permanent loss or freezing of funds $100k+ (Possible)

Temporary freezing of funds (Very Likely)

Loss of yield (Very Likely)

Miner-extractable value (MEV)

Unable to call smart contract

Permanent loss or freezing of funds $1m+ (Very Unlikely)

Permanent loss or freezing of funds $100k+ (Unlikely)

Temporary freezing of funds

Loss of yield

![Screenshot 2023-03-22 at 2.14.14 PM](//images.ctfassets.net/t3wqy70tc3bv/7phFwTw1I2KTlieqdYifvw/cf2d7363fa764395eb54203899318794/Screenshot_2023-03-22_at_2.14.14_PM.png)

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

There is one exception for this bug bounty program, which overrides one vulnerability in the vulnerability scale, in the above Immunefi Vulnerability Severity Classification System:
  - The vulnerability of: “Token holders temporarily unable to transfer holdings” will be classified under this bug bounty program as a medium vulnerability. 

Vulnerabilities marked as “Acknowledged” in the [https://www.certik.org/projects/dhedge](https://www.certik.org/projects/dhedge) are not eligible for a reward.

dHedge vaults are trust minimized, meaning that the vault manager may not follow a set strategy, or may make bad trades, including trades with poor slippage. A complete loss of funds is possible via poor risk-management strategies by the manager. These types of losses are not in scope for the bounty.

Payouts are handled by the __dHEDGE__ team directly and are denominated in USD. However, payouts are done in __USDC__.

__Please note, from May, 22nd through June 17th, dHEDGE will be undergoing a Public Audit. During this time, any in-scope bug submission reported to this program, that was also submitted for the contest, by one or more reporters, will be considered a 'Known Issue' and closed as out of scope. Additionally, valid bug reports submitted during the audit may have their rewards delayed until the audit is completed.A full list of reported known issues will be provided, and this program will be updated once the audit is completed.__

dHEDGE

Resources & Documentation