All smart contracts of Goldfinch can be found at [https://github.com/goldfinch-eng/goldfinch-contracts](https://github.com/goldfinch-eng/goldfinch-contracts). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.


Goldfinch is a decentralized protocol that allows for crypto borrowing without crypto collateral. The Goldfinch protocol has four core participants: Borrowers, Backers, Liquidity Providers, and Auditors.

Loss of user funds

Loss of governance funds

Loss of principle user funds

Theft of yield

Unintended behavior relating to money transfers (ie. user input is for 10 USDC, and we actually try to move 100 USDC)

Logical bugs relating to calculation of interest or principal owed, or payment dates, etc.

Incorrect or unintended behavior relating to money. (ie. user input is for 10 USDC on the app, and we actually send 100 USDC to the smart contract)

Temporary freezing of user or governance funds

Theft of yield equal to or below USD 200 000

Failure of access controls

We are pointing to an incorrect smart contract

Cross-site request forgery (CSRF)

Cross-site scripting (XSS)

“Clickjacking state-changing” that can result in any user losing funds or being tricked into unintended behavior involving money through Goldfinch’s front-ends (only if the total impact is equal to or greater than USD 10 000)

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web/app bug reports must come with a PoC in order to be considered for a reward.

“Clickjacking state-changing” is considered “High” if it could result in greater than __USD 10 000__ worth of such damages. 

The payout for critical and high severity bugs is calculated as the minimum of 10% of economic damage from the exploit and the maximum payout for the exploit’s severity level; however there is a minimum reward of __USD 5 000__ for valid critical bug reports, and a minimum reward of __USD 1 000__ for valid high severity bug reports.

In order to be eligible for a reward, the following terms and conditions must be met:

  - Identify an original, previously unreported, non-public vulnerability within the scope of the Goldfinch bug bounty program as described.
  - Include sufficient detail in your disclosure to enable our engineers to quickly reproduce, understand, and fix the vulnerability.
  - Be at least 18 years of age.
  - Be reporting in an individual capacity, or if employed by a company, reporting with the company’s written approval to submit a disclosure to Goldfinch.
  - Not be subject to US sanctions or reside in a US-embargoed country.
  - Not be a current or former Goldfinch employee, vendor, contractor, or employee of a Goldfinch vendor or contractor.

Vulnerabilities in contracts built on top of Goldfinch by third-party developers (such as smart contract wallets) are not in-scope, nor are vulnerabilities that require ownership of an admin key.

Known bugs found at the following link are considered out of scope for the program:

[https://goldfinchfinance.notion.site/ImmuneFi-Publication-List-of-Known-Goldfinch-Protocol-Issues-2a222523415640f886d1bb8f10f622ef](https://goldfinchfinance.notion.site/ImmuneFi-Publication-List-of-Known-Goldfinch-Protocol-Issues-2a222523415640f886d1bb8f10f622ef)

Payouts are handled by the __Goldfinch__ team directly and are denominated in USD. However, payouts are done in __USDC__.