All smart contracts of Olympus can be found at [https://github.com/OlympusDAO/olympus-contracts](https://github.com/OlympusDAO/olympus-contracts). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Olympus is a protocol with the goal of establishing OHM as a crypto-native reserve currency. It conducts autonomous and dynamic monetary policy, with market operations supported by the protocol-owned Olympus Treasury.

Loss of treasury funds

Loss of user funds

Loss of bond funds

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

This is a Custom Program, governed by __OlympusDAO__. The program is subcategorized into four tiers, with only the below impacts considered for a reward:

  - Tier 1: For bugs/exploits which would lead to a loss of bond funds or a loss of user funds, a reward amount equal to the potential loss of funds up to __USD 333 333__ (paid in OHM) is provided.

  - Tier 2: For bugs/exploits which would lead to a loss of treasury funds, a reward amount equal to the potential loss of funds up to __USD 3,333,333 __(paid in OHM) is provided.

  - Tier 3: For bugs/exploits which would lead to an incorrect rebase amount, a reward amount equal to the potential loss of funds up to __USD 33,333__ (paid in OHM) is provided.

  - Tier 4: The Bug Bounty Management team may from time to time, at its discretion, issue an award of up to __$16,942.00__ for submissions which do not qualify for bounties under other tiers, but which the team feels nonetheless are high effort, high quality, and of material use in improving Olympus’ security. Note that this bounty is not available to Olympus contributors, who should contact the Bug Bounty Management team directly for a bounty if they have found a bug or inefficiency that is outside of their mandate as a contributor. Further note that this bounty will not be awarded regularly. It is meant only for extremely high quality submissions which have significant material impacts to Olympus. No person submitting a bounty should assume that they are entitled to this or will be awarded it, as the bar to qualify for it will be very high.

For vulnerabilities of websites and applications, only bugs that lead to direct financial damage listed in the Impacts in Scope are accepted and are categorized as critical. All others are not accepted. An example of an acceptable vulnerability in this category would be [https://rekt.news/badger-rekt/ ](https://rekt.news/badger-rekt/)

Bugs that have been previously disclosed, either publicly or in an earlier bug submission, are ineligible for a reward.

Payouts are handled by the __Olympus DAO__ directly and are denominated in __USD__, under the terms set out in OIP-38. However, payouts are done in __OHM__.

__Reward Payment Terms__

Payouts are handled by the __Olympus__ team directly and are denominated in __USD__. However, payments are done in __OHM__

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Olympus

Resources & Documentation