monero-oxide is a collection of Rust libraries to work with the Monero protocol.

Incompatibilities with the targeted Monero consensus protocol which would require reimplementing notable sections of monero-oxide

Non-constant-time implementation with regards to secret data

Undocumented panic reachable from a public API

Unintended, undocumented recovery of private spend keys (or private spend key shares)

Incompatibilities with the targeted Monero wallet protocol which would require reimplementing notable sections of monero-oxide

Signing of unintended messages

Reportedly received funds which weren’t actually received

Ability to forge proofs present with only the default features

Incorrect/incomplete cryptographic formula

Undocumented fingerprints in created transactions, when compared to the targeted version of Monero’s wallet2

Codebase

Documentation and further resources

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). 

__Reward Calculation for Critical Level Reports__

For critical Blockchain/DLT bugs, the reward is 100,000 USD. For high Blockchain/DLT bugs, the reward is 10,000 USD. For medium Blockchain/DLT bugs, the reward is 5,000 USD. For low Blockchain/DLT bugs, the reward is 1,000 USD.

__Reward Payment Terms__

Payouts are handled by Power Up Privacy directly and are denominated in **USD**. However, payments are done in **XMR** on **Monero**

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.