In addition, the current implementation contracts of all the listed proxy contracts are in scope. 

All smart contracts of Origin Dollar can be found at [https://github.com/OriginProtocol/origin-dollar/tree/master/contracts/contracts](https://github.com/OriginProtocol/origin-dollar/tree/master/contracts/contracts). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Origin Protocol is a suite of complimentary DeFi products designed to increase economic opportunity for all. These permissionless and composable smart contracts provide superior user experiences across DeFi in a groundbreaking multichain yield ecosystem.

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Ability to execute system commands

Stealing User Cookies

Signing transactions for other users

Redirection of user deposits and withdrawals

Subdomain takeover resulting in financial loss (applicable for subdomains with addresses published)

Wallet interaction modification resulting in financial loss

Direct theft of user funds

Tampering with transactions submitted to the user’s wallet

Submitting malicious transactions to an already-connected wallet

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. 

All Smart Contract and Web/app bug reports must come with a PoC in order to be considered for a reward.

The known issues listed below are considered out of scope: 

  - All issues found in their past audits here: [https://docs.ousd.com/security-and-risks/audits](https://docs.ousd.com/security-and-risks/audits)

  - OUSD does not guarantee which stablecoins will make up the backing stablecoins nor the value of those backing stable coins. Attacks which only change the mix of stablecoins, but do not reduce the total number of stablecoins held are excluded.

  - Reductions in the number of backing stablecoins due to governance or strategist actions that move coins into or out of strategies, where the reduction comes from the normal fees of the underlying strategy or the price difference of stablecoins being moved in or out are excluded.

  - Rounding in the flipper contract is intentional.

Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of __USD 50 000__ for Critical bug reports on smart contracts. 

Payouts are handled by the __Origin Protocol__ team directly and are denominated in USD. However, payouts are done in __OUSD__.