**Whenever the asset is a smart contract proxy, its implementation is also in scope.**

However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Optimism is a blockchain infrastructure provider that enables developers and enterprises to launch scalable, secure and customizable networks and applications. The company serves fintechs, payment providers, institutions and crypto companies creating the next generation of onchain products. Optimism's open-source OP Stack delivers Ethereum-grade security, nearly-free transactions, and the flexibility to meet complex business needs at scale.

Permanent freezing of funds

Protocol insolvency

Direct loss of funds

Network not being able to confirm new transactions (Total network shutdown)

Execute arbitrary system commands

Retrieve sensitive data/files from a running server, such as:
- /etc/shadow
- database passwords
- blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking and/modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:
- Changing registration information
- Commenting
- Voting
- Making trades
- Withdrawals, etc.

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet, such as:
- Modifying transaction arguments or parameters
- Substituting contract addresses
- Submitting malicious transactions

Injection of malicious HTML or XSS through metadata

Injecting/modifying the static content on the target application without JavaScript (persistent), such as:
- HTML injection without JavaScript
- Replacing existing text with arbitrary text
- Arbitrary file uploads, etc.

Improperly disclosing confidential user information, such as:
- Email address
- Phone number
- Physical address, etc.

Subdomain takeover without already-connected wallet interaction

Transient consensus failures

Denial of Service attacks targeting distinct users

Memory pool information leaks allowing for MEV searchers to read the list of pending transactions

Issues in the dispute-mon service that would cause the service to silently fail to properly detect an incorrectly resolving dispute game within the airgap window

Loss of user funds by direct theft, other than unclaimed yield

Temporary freezing of funds (e.g. recoverable via an upgrade)

Incorrectly resolved dispute game (mitigated by a delay)

Incorrectly proven withdrawal (mitigated by a delay)

Incorrectly initiated bond withdrawal (mitigated by a delay)

Incorrectly resolved dispute game (mitigated by a delay AND requires calling FaultDisputeGame.step() against a claim at MAX_GAME_DEPTH or calling FaultDisputeGame.attack or FaultDisputeGame.defend against a claim at MAX_GAME_DEPTH-2).

Freezing of funds (fix requires L2 hardfork)

Taking down the application/website

Optimism smart contracts

Documentation and further resources

Previous Audits

__Rewards by Threat Level__:

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System.](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2/) This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Since Optimism uses a fork of Geth, issues which are responsibly disclosed to upstream cannot be "replayed" against Optimism’s bug bounty program if the vulnerability has already been made public. If the vulnerability is disclosed to Optimism at the same time as upstream Geth, the vulnerability is eligible for the bug bounty program.

A PoC, demonstrating the bug's impact, is required for this program and has to comply with the [Immunefi PoC Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules).

For KYC, OptimismPBC will request a W-9 if you reside in the US or a W-8 if you reside outside the US.

Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of __USD 75 000__ for Critical bug reports.

For testing any exploits involving cross-domain transactions, we recommend working with our [dockerized services](https://github.com/ethereum-optimism/optimism/blob/6f8e432506a5f4ba094f091b22a0bb6acc53fdac/ops/README.md) and modifying our [integration tests](https://github.com/ethereum-optimism/optimism/blob/6f8e432506a5f4ba094f091b22a0bb6acc53fdac/integration-tests/test/bridged-tokens.spec.ts)

__Governance Proposals:__

In addition to the above assets listed, the calldata and code for the latest Protocol Upgrade Proposals (not for Governor Upgrade proposals, or proposal previews) is also in scope. This must be an official governance proposal, meaning it has either (1) moved to onchain vote appearing on vote.optimism.io, or (2) has been posted by someone from OP Labs or the Optimism Foundation, or (3) a comment has been left by someone from OP Labs or the Optimism Foundation indicating it's eligible for the bounty. The latest in-flight governance proposal can be found at https://gov.optimism.io/c/technical-proposals/protocol-upgrade/.

Title	Description	Link
Optimism smart contracts	Program smart contracts
Documentation and further resources	Optimism Docs

Optimism

Codebase

Documentation