Smart Contracts labeled or categorized as testnet are not in scope of this bug bounty program. 

Subdomains other than the one listed in this table are not included in the bug bounty program scope.

Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol Insolvency

Oracle failure/manipulation

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames)

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc.

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

Theft of tokenized staking yield

Permanent freezing of tokenized staking yield

Temporary freezing of funds

Acquiring owner/admin rights or roles without contract’s owner/admin action

Missing access controls / unprotected internal interfaces

Economic/financial attacks

Re-entrancy

Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc.

Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, etc.

Improperly disclosing confidential user information such as email address, phone number, physical address, etc.

Subdomain takeover without already-connected wallet interaction

Taking down the application/website

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Susceptibility to frontrunning

Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as changing the first/last name of user, or en/disabling notification

Injecting/modifying the static content on the target application without Javascript (Reflected) such as reflected HTML injection or loading external site data

Redirecting users to malicious websites (Open Redirect)

Contract fails to deliver promised returns, but doesn't lose value

Changing details of other users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction such as iframing leading to modifying the backend/browser state (

Taking over broken or expired outgoing links such as social media handles, etc.

Temporarily disabling user to access target site, such as locking up the victim from login, cookie bombing, etc.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web and app bugs must come with a PoC in order to be accepted. All web and app bug reports without a PoC will be rejected with a request for a PoC.

__Smart Contracts Rewards Breakdowns__

  - __Smart Contracts Critical:__

    - Loss of user funds: 
      - 1% of assets at risk, minimum 100 000 USD, maximum 2 000 000 USD
    - Loss of non-user funds (e.g. treasury): 
      - 1% of assets at risk, minimum  50 000 USD , maximum 1 000 000 USD

  - __Smart Contracts High:__

    - 1% of assets at risk when attack persists for 1 month
      -  minimum 20 000 USD, maximum of 400 000 USD

  - __Smart Contracts Medium:__

    - 1% of assets at risk when attack persists for 1 month 
      - minimum 5 000 USD, maximum 100 000 USD

  - __Smart Contracts Low:__

     - 2 000 USD

__Web/App Rewards Breakdowns__

  - __Web/App Critical:__

    -  40 000 USD

  - __Web/App High:__

    -  7 500 USD  
    -  If attack can modify the transaction users approve so it sends funds to the wrong address: then this reward increases to a total of 40 000 USD

  - __Web/App Medium:__

    -  3 250 USD

  - __Web/App Low:__

    -  500 USD  

Payouts are handled by the __Lido__ team directly and are denominated in __USD__. Payouts can be done in __ETH__, __DAI__, __RAI__, or __LDO__, at the decision of the bug bounty hunter.

Lido

Resources & Documentation