Stable 2 Well Function Lookup Table with A = 1

All Pinto smart contracts can be found at [https://github.com/pinto-org/protocol](https://github.com/pinto-org/protocol). All Pinto Exchange smart contracts can be found at [https://github.com/pinto-org/exchange](https://github.com/pinto-org/exchange). However, only those in the Assets in Scope section are considered as in-scope of the bug bounty program. The following links may also be helpful:
- [Pinto Docs](https://docs.pinto.money)
- [Pinto Discord](https://pinto.money/discord)
- [Pinto Exchange Docs](https://docs.pinto.exchange)

[Pinto](https://pinto.money) is low volatility money built on Base. This bug bounty program is focused on securing both Pinto and [Pinto Exchange](https://pinto.exchange/). For more information about Pinto, see the [whitepaper](https://pinto.money/pinto.pdf) and [docs](https://docs.pinto.money).

Execute arbitrary system commands

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Direct theft of user funds

Temporary freezing of funds for at least 1 hour

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Illegitimate minting of protocol native assets

Contract fails to deliver promised returns, but doesn't lose value

Invariant is missing on a function where it should be implemented

Exploit is possible but is exclusively prevented by an invariant

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as voting in governance.

Injecting code that results in malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

If an impact can be caused to any other asset related to Pinto or Pinto Exchange that isn’t on this section but for which the impact is in the Impacts in Scope section below, bug bounty hunters are encouraged to submit it for consideration by the PCM.

Note that unexpected outcomes (like loss of funds) due to misuse of Pipeline do not qualify as valid bug reports. Read more [here](https://evmpipeline.org/pipeline.pdf?utm_source=immunefi#section.6).

Also note that the various ecosystem subgraphs are not included as Assets in Scope.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). The following is a simplified 3-level scale, focusing on the impact of the vulnerability reported. The complete scope can be found below.

In order to be considered for the maximum potential reward, bug reports must come with a Proof of Concept (PoC). Explanations and statements are not accepted in lieu of a PoC. Bug reports that do not come with a PoC may qualify for a maximum of up to 30% of the potential reward outlined below, as determined by the PCM or the committee it selects to operate the bug bounty program.

Funds at Risk for a given bug report are defined as follows:

- Funds at Risk are determined based on the token amounts and USD values at time of the bug report submission;
- For Pinto, Funds at Risk are determined based on the liquidatable USD value of the Pinto at risk;
- For non-Pinto (ETH, WETH, WSOL, cbBTC, cbETH, USDC, etc.) in any in-scope assets, the Funds at Risk are determined based on their respective USD values;
- For non-Pinto in Wallet Balances (i.e., outside of any in-scope assets), the Funds at Risk are determined to be 50% of their respective USD values; and
- If the smart contract where the vulnerability exists can be upgraded or paused, only the Funds at Risk in initial attacks that can be executed within the first hour will be considered for a reward.

__Reward Calculation for Critical Smart Contract Reports__

Rewards for Critical smart contract vulnerabilities are capped at the lower of (a) 10% of practicable economic damage, or (b) USD 1 200 000, primarily taking into consideration the Funds at Risk. However, there is a minimum reward of USD 100 000 for Critical severity smart contract bug reports.

__Reward Calculation for High Smart Contract Reports__

Rewards for High smart contract vulnerabilities are capped at the lower of (a) 10% of practicable economic damage, or (b) USD 100 000, primarily taking into consideration the Funds at Risk. However, there is a minimum reward of USD 10 000 for High severity smart contract bug reports.

__Reward Calculation for Medium Smart Contract and All Website and Applications Reports__

Rewards for Medium severity smart contract vulnerabilities and all website and applications vulnerabilities are scaled based on a set of internal criteria established by the PCM. However, there is a minimum reward of **USD 1 000** for Medium smart contract bug reports and **USD 5 000** for Critical website and applications bug reports. The PCM will primarily take into account:
- The exploitability of the bug;
- The impact it causes; and
- The likelihood of the vulnerability presenting itself.

__Reward Payment Terms__

Payouts are handled by the Pinto Contract Multisig directly (or via a committee it selects) and are done in PINTO. Note that rewards can take some time to be paid out after a report is confirmed to be valid.

__PCM Determination__

The PCM shall determine whether a submitting party is entitled to a bug bounty/reward, and if so, the amount of such bounty/reward (and specifically, whether such submission qualifies for a Critical, High or Medium Impact bounty/reward, what is the potential practicable economic damage of such bug based on the Funds at Risk, and what the appropriate bounty/reward should be within each Impact range). The PCM’s determination of (i) whether such submission qualifies for a Critical, High or Medium Impact bounty/reward, (ii) what is the potential practicable economic damage of such bug based on the Funds at Risk, and (iii) whether such submission came with a PoC, thereby enabling it to be considered for the maximum potential applicable reward (vs. a submission that did not come with a PoC, thereby limiting such submission to a maximum of up to 30% of the applicable reward), shall be made in the PCM’s sole and absolute discretion absolute and shall be final, and not be subject to any appeal or challenge.

A submitting party may only dispute the PCM’s determination (a) that a submitting party is not entitled to any bug bounty/reward, or (b) what the appropriate bounty/reward should be within each Impact range. In such disputes, Immunefi will conduct a binding mediation. If the submitting party disputes the PCM’s decision that a submitting party is not entitled to any bug bounty/reward, Immunefi will mediate, and shall determine, in its sole and absolute discretion, which is non-appealable, whether the submitting party is entitled to any bug bounty/reward, and if so, the amount of such bug bounty/reward, up to **USD 10 000** in the case of a smart contract bug reports (i.e., as if it were a Medium Impact fix), and up to **USD 1 000** in the case of a website and applications bug report (i..e, as if it were a Critical Impact fix). If the submitting party disputes the PCM’s determination what the appropriate bounty/reward should be within a specific Impact range, Immunefi will mediate, and shall determine, in its sole and absolute discretion, which is non-appealable, the amount of such bug bounty/reward in the relevant Impact category; however, Immunefi may not modify or change (i) the practicable economic damage determination made by the PCM, or (b) the PCM determination whether such submission came with a PoC, thereby enabling it to be considered it for the maximum potential applicable reward (vs. a submission that did not come with a PoC, thereby limiting such submission to a maximum of up to 30% of the applicable reward).