Special NFT for Partially Fillable Orders

Unless explicitly listed, only pages of the web/app assets in addition to the direct link are considered in-scope of the bug bounty program. Other subdomains are not considered as in-scope. However, for subdomain takeovers that lead to an impact on the in-scope asset, please refer to our page about [Reported Subdomain Takeovers.](https://immunefisupport.zendesk.com/hc/en-us/articles/14352199704593-Reported-Subdomain-Takeovers)

Genius Yield is the all-in-one DeFi platform, that combines an order-book decentralized exchange (DEX) with an AI-powered yield optimizer, built from the ground up on the Cardano blockchain and designed to take advantage of benefits provided by Cardano’s EUTxO smart contracts, such as security, determinism, parallelism, scalability, and composability.

Injecting/modifying the static content on the target application without Javascript (Persistent) such as: HTML injection without Javascript Replacing existing text with arbitrary text Arbitrary file uploads, etc

Subdomain takeover without already-connected wallet interaction

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds

Temporary freezing NFTs

Retrieve sensitive data/files from a running server such as: /etc/shadow database passwords blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information Making trades Withdrawals

Changing the NFT metadata

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as: Modifying transaction arguments or parameters Substituting contract addresses Submitting malicious transactions

Direct theft of user NFTs

Injection of malicious HTML or XSS through NFT metadata

Execute arbitrary system commands

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Permanent freezing of funds

Permanent freezing of NFTs

Unauthorized minting of NFTs

Predictable or manipulable RNG that results in abuse of the principal or NFT

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Protocol insolvency

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Reward Calculation for Critical Level Reports__

For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD $25,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD $15,000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

Critical website and application bug reports will be rewarded with USD 15,000, only if the impact leads to a direct loss in funds involving an attack that does not require any user action at all. An impact of minting tokens on-chain beyond intended activity without requiring any user action would also be rewarded this amount due to the undesired dilution of existing circulating tokens. All other impacts that would be classified as Critical, or an impact resulting in a theft of funds that does not fall under this definition, would be rewarded USD 10,000.

__Reward Calculation for High Level Reports__
 
For high smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD $10,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD $6,000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

__Repeatable Attack Limitations__

If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward. This is because the project can mitigate the risk of further exploitation by upgrading or pausing the component where the vulnerability exists. The reward amount will depend on the severity of the impact and the funds at risk.


__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:

- Website and Applications, Critical
- Website and Applications, High
- Smart Contract, Critical
- Smart Contract, High


All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules?utm_source=immunefi). Bug report submissions without a PoC, when a PoC is required, will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the __Genius Yield__ team directly and are denominated in __USD__. However, payments are done in __GENS__. 

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5,000 and the average price is USD 0.20 per token, then the reward will be 25,000 units of GENS token.