All smart contracts of Polkastarter can be found at [https://github.com/polkastarter](https://github.com/polkastarter). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.


Polkastarter is a protocol built for cross-chain token pools and auctions, enabling projects to raise capital in a decentralized, permissionless and interoperable environment based on Polkadot.

Loss of user funds staked (principal) by freezing or theft

Anything that can lead to loss of user funds

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All critical bug reports must come with a PoC in order to be considered for a reward.

Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of __USD 50 000__ for Critical bug reports. 

Payouts are handled by the __Polkastarter__ team directly and are denominated in USD. Payouts are done in __USDC__ or __USDT__, up to the discretion of the team.

Polkastarter

Resources & Documentation