The list of all deployed contracts can be found at: [https://static.polygon.technology/network/mainnet/v1/index.json](https://static.polygon.technology/network/mainnet/v1/index.json)

Impacts only apply to assets in active use by the project like contracts on mainnet or web/app assets used in production. 

**For GitHub repositories please ensure you are reviewing the latest published releases and not the default branch**

Any impact that applies to assets not in active use, like test or mock files, are out-of-scope of the bug bounty program unless explicitly mentioned as in-scope. In the case of Smart Contracts, please always make sure the code has been deployed and present in the JSON file on the first row.

__Blockchain/DLT__

  - __Blockchain/DLT - PoC__, Blockchain/DLT bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

  - __Smart Contracts - PoC__, Smart Contract bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

__Dev Environment and Documentation__ 

Polygon Labs has included dev documentation and/or instructions to help in reviewing code and looking for bugs:

| __Dev or Staging Environment Links__     |
| ---------- |
| https://docs.polygon.technology/](https://docs.polygon.technology/)        |

Polygon is a fast, low cost, and battle tested blockchain. Live for 5+ years, with 99.99% uptime and millions of users, join them in moving money and RWAs today.

Temporary freezing of funds

Theft of user fees

Direct loss of funds

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Protocol insolvency

Transient consensus failures

Denial of service attacks

Loss of bridge or staking funds

Network not being able to confirm new transactions (total network shutdown)

Temporary freezing of funds for less than 1 week

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table. The final classification however takes into consideration the likelihood of the impact being achieved based on the table below. When submitting a bug report, select the original assigned impact level, but please be aware that its severity level may be reassigned based on the likelihood according to this table.

|                    | Low Impact | Medium Impact | High Impact |
|--------------------|------------|----------------|--------------|
| **High Probability**   | MEDIUM     | HIGH           | CRITICAL     |
| **Medium Probability** | LOW        | MEDIUM         | HIGH         |
| **Low Probability**    | LOW        | LOW            | MEDIUM       |


In addition to Immunefi’s Vulnerability Severity Classification System, Polygon classifies vulnerabilities using the Common Vulnerability Scoring System (CVSS). In case of discrepancy, final determination is done by Polygon.

__Impacts to other assets__ 

Hackers are encouraged to submit issues outside of those outlined Impacts and Assets in Scope. 

If Whitehats can demonstrate a critical impact of code in production for an asset not in scope, Polygon Labs encourages you to submit your bug report using the “primacy of impact exception” asset as outlined below.

__Reward Distribution__

Payouts over the lower bound reward are directly related to the direct funds at risk. If no funds are at risk, the Critical or High payouts are limited to the minimum, unless decided otherwise by Polygon Labs.

For the purposes of clarification, funds at risk refer to the proof of loss of funds.

Rewards for critical Blockchain/DLT and smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 50 000__.

__Payouts and Payout Requirements__

Payouts are handled by the Polygon Labs team directly and are denominated in USD. Payouts are done in USDC or POL at the Polygon Labs teams' discretion. Polygon Labs commits to honoring payouts according to the terms set out in this program at the time of report submission, and to treat this program as the agreement and source of truth concerning bug reports and responsible disclosures. 

POL Payouts will be determined using TWAP 5 day price calculated from payment date.

Polygon Labs requires an invoice to be received for each payout. An invoice template can be provided by Polygon Labs.

This bug bounty program is only open to individuals who reside outside of the countries that are restricted by OFAC and by UNSC resolutions. If the individual is a US person, tax information may be required in order to properly issue a 1099.

Polygon Labs requires an invoice to be received for each payout. An invoice template can be provided by Polygon Labs.

__KYC Requirements__

Polygon Labs does have a Know Your Customer (KYC) requirement for bug bounty payouts. 

| __KYC Info Required__     |
| ---------- |
| Wallet Address       |
| Passport |
| Place of residence |

KYC information is only required on confirmation of the validity of a bug report which Polygon Labs determines in its sole discretion.