All smart contract code of Linea can be found at [https://github.com/Consensys/linea-contracts/tree/b17e7c79b5647e47c175c6367dea30c3f1c66738/contracts](https://github.com/Consensys/linea-contracts/tree/b17e7c79b5647e47c175c6367dea30c3f1c66738/contracts). Documentation for the assets provided in the table can be found at [https://docs.linea.build/](https://docs.linea.build/)

Other helpful links include:
- Infura docs - [https://docs.infura.io/networks/linea](https://docs.infura.io/networks/linea)
- RPC [https://linea-goerli.infura.io/v3/](https://linea-goerli.infura.io/v3/)

Linea is a type 2 zero knowledge Ethereum Virtual Machine (zkEVM). A zkEVM replicates the Ethereum environment as a rollup and allows developers to build on it as they would on Ethereum mainnet. Linea allows you to deploy any smart contract, use any tool, and develop as if you're building on Ethereum.

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Theft of gas

Unbounded gas consumption

Contract fails to deliver promised returns, but doesn't lose value

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.

__Repeatable Attack Limitations__

In cases of repeatable attacks or attacks stemming from the same root cause, for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Restrictions on Security Researcher Eligibility__

Security researchers need to comply with the following to be eligible for a reward:
- You represent to us that you and your financial institutions, or any party that owns or controls you or your financial institutions, are (1) not subject to sanctions or otherwise designated on any list of prohibited or restricted parties, including but not limited to the lists maintained by the United Nations Security Council, the U.S. Government (i.e., the Specially Designated Nationals List and Foreign Sanctions Evaders List of the U.S. Department of Treasury and the Entity List of the U.S. Department of Commerce), the European Union or its Member States, the United Kingdom, or other applicable government authority and (2) not located in any country subject to a comprehensive sanctions program implemented by the United States.

__Previous Audits__

Consensys has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.

__First Audit Round__

__Diligence:__

- Plonk Verifier: [https://consensys.io/diligence/audits/2023/06/linea-plonk-verifier/](https://consensys.io/diligence/audits/2023/06/linea-plonk-verifier/)
- Message Service & Rollup: [https://consensys.io/diligence/audits/2023/06/linea-message-service/](https://consensys.io/diligence/audits/2023/06/linea-message-service/)
- Canonical Token Bridge:
[https://consensys.io/diligence/audits/2023/06/linea-canonical-token-bridge/](https://consensys.io/diligence/audits/2023/06/linea-canonical-token-bridge/)

__Open Zeppelin:__ 

  - Linea Bridge Audit: https://blog.openzeppelin.com/linea-bridge-audit-1
  - Linea Verifier Audit: https://blog.openzeppelin.com/linea-verifier-audit-1 

__Second Audit Round__

__Diligence:__

- Proof aggregation, data compression and message service updates audit: [https://consensys.io/diligence/audits/2024/01/linea-contracts-update/](https://consensys.io/diligence/audits/2024/01/linea-contracts-update/)

__Open Zeppelin:__ 

- Proof aggregation, data compression and message service updates audit: [https://blog.openzeppelin.com/linea-v2-audit](https://blog.openzeppelin.com/linea-v2-audit)

__Third Audit Round__

__Open Zeppelin__ 
- Blob submission audit: [https://blog.openzeppelin.com/linea-blob-submission-audit](https://blog.openzeppelin.com/linea-blob-submission-audit) 

__Fourth Audit Round (Latest)__

__Open Zeppelin__
- Gas optimization and token bridge update audit: [https://blog.openzeppelin.com/linea-gas-optimizations-audit](https://blog.openzeppelin.com/linea-gas-optimizations-audit)  

__Cyfrin__ 
- Full codebase audit including recent gas optimizations and TokenBridge updates: [https://github.com/Cyfrin/cyfrin-audit-reports/blob/main/reports/2024-05-24-cyfrin-linea-v2.0.pdf](https://github.com/Cyfrin/cyfrin-audit-reports/blob/main/reports/2024-05-24-cyfrin-linea-v2.0.pdf) 


__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract - Critical
- Smart Contract - High
- Smart Contract - Medium
- Smart Contract - Low

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the ConsenSys team directly and are denominated in USDC.

Linea

Resources & Documentation