Only web/app vulnerabilities that __directly__ affect the web/app assets listed in this table and their subfolders are accepted within the bug bounty program. All others are out-of-scope.

Under the Github link, only mainnet smart contract vulnerabilities are considered in-scope for the bug bounty program. Smart contracts labeled as testnet are out-of-scope. Additionally, __all smart contracts in the test, oracle, and reader folders are out-of-scope__. 

Vulnerabilities surfaced in the audits provided by [ConsenSys](https://diligence.consensys.net/audits/private/nxaosool-mcdexio-mai-protocol-v2), [OpenZeppelin](https://blog.openzeppelin.com/mcdex-mai-protocol-audit/) and [Quantstamp](https://certificate.quantstamp.com/full/mcdex) are not considered in scope of the bug bounty program even if they affect the assets listed in this table.

MUX is a decentralized leveraged trading protocol allowing zero price impact trading, up to 100x leverage, no counterparty risks for traders and an optimized on-chain trading experience. In addition, MUX is the first multi-chain native protocol unifying pooled liquidity across deployed chains to maximize capital efficiency.

Any governance voting result manipulation

Direct theft of >1% of user funds, other than unclaimed yield, in excess of gas costs or swap fees

Permanent freezing of >1% of total funds in excess of gas costs or swap fees

Miner-extractable value (MEV)

Protocol Insolvency

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc.

Subdomain takeover with already-connected wallet interaction

Direct theft of >1% of total user funds

Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

Theft of >1% of total unclaimed yield

Permanent freezing of >1% of total unclaimed yield

Temporary freezing of funds

Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc.

Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, etc.

Improperly disclosing confidential user information such as email address, phone number, physical address, etc.

Subdomain takeover without already-connected wallet interaction

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as changing the name of user, or enabling/disabling notifications

Injecting/modifying the static content on the target application without Javascript (Reflected) such as reflected HTML injection or loading external site data

Redirecting users to malicious websites (Open Redirect)

Contract fails to deliver promised returns, but doesn't lose value

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web and app bugs must come with a Proof of Concept (PoC) in order to be accepted. All web and app bug reports without a PoC will be rejected with a request for a PoC. Critical web and app bugs can only be paid the full USD 15 000 if there is a vulnerability directly leading to a loss in user funds that don’t require social engineering or extensive non-normal user actions. 

Rewards for smart contract vulnerabilities are variable based on their exploitability, and other factors deemed relevant by the MUX team. For critical vulnerabilities, the payout is capped at 10% of economic damage and is the main determinant of the reward amount. Bug reports for critical vulnerabilities also require PoC. If no PoC is submitted but the bug is still validated and addressed, only USD 50 000 will be rewarded regardless of economic damage. 

Recommendations for fixes are required for a reward. Though bug reports without recommendations for fixes may be considered, the resulting reward cannot be the maximum amount. 

The final decision for all rewards are at the discretion of MUX Protocol. 

Payouts are handled by the __MUX Protocol__ team directly and are denominated in USD. Payouts are done in __USDC__. However, for payouts USD 1 000 and lower, the reward can be paid in __ETH__.

MUX

Resources & Documentation