MUX

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web and app bugs must come with a Proof of Concept (PoC) in order to be accepted. All web and app bug reports without a PoC will be rejected with a request for a PoC. Critical web and app bugs can only be paid the full USD 15 000 if there is a vulnerability directly leading to a loss in user funds that don’t require social engineering or extensive non-normal user actions.

Rewards for smart contract vulnerabilities are variable based on their exploitability, and other factors deemed relevant by the MUX team. For critical vulnerabilities, the payout is capped at 10% of economic damage and is the main determinant of the reward amount. Bug reports for critical vulnerabilities also require PoC. If no PoC is submitted but the bug is still validated and addressed, only USD 50 000 will be rewarded regardless of economic damage.

Recommendations for fixes are required for a reward. Though bug reports without recommendations for fixes may be considered, the resulting reward cannot be the maximum amount.

The final decision for all rewards are at the discretion of MUX Protocol.

Payouts are handled by the MUX Protocol team directly and are denominated in USD. Payouts are done in USDC. However, for payouts USD 1 000 and lower, the reward can be paid in ETH.