The list of all deployed contracts can be found at: [https://static.polygon.technology/network/mainnet/v1/index.json](https://static.polygon.technology/network/mainnet/v1/index.json)

Impacts only apply to assets in active use by the project like contracts on mainnet or web/app assets used in production. 

For GitHub repositories please ensure you are reviewing the latest published releases and not the default branch

Any impact that applies to assets not in active use, like test or mock files, are out-of-scope of the bug bounty program unless explicitly mentioned as in-scope. In the case of Smart Contracts, please always make sure the code has been deployed and present in the JSON file on the first row.

__Blockchain/DLT__

  - __Blockchain/DLT - PoC__, Blockchain/DLT bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

  - __Smart Contracts - PoC__, Smart Contract bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

__Dev Environment and Documentation__ 

Polygon Labs has included dev documentation and/or instructions to help in reviewing code and looking for bugs:

| __Dev or Staging Environment Links__     |
| ---------- |
| https://wiki.polygon.technology/](https://wiki.polygon.technology/)        |

Polygon is a Layer 2 scaling solution that achieves scale by utilizing sidechains for off-chain computation and a decentralized network of Proof-of-Stake (PoS) validators.

Temporary freezing of funds for at least 1 week

Theft of user fees

Unintended chain split (network partition)

Transient consensus failures

Theft of gas

Denial of service attacks

Unbounded gas consumption

DoS and does not shut down the network

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Network not being able to confirm new transactions (Total network shutdown requiring hard fork)

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hard fork)

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table. The final classification however takes into consideration the likelihood of the impact being achieved based on the table below. When submitting a bug report, select the original assigned impact level, but please be aware that its severity level may be reassigned based on the likelihood according to this table.         

| Impact \ Likelihood     | Critical     | High     | Medium     | Low     | Informational     |
| ---------- | ---------- | ---------- | ---------- | ---------- | ---------- |
| Critical       | Critical       | Critical       | High       | Medium       | Informational       |
| High       | High       | High       | High       | Medium       | Informational       |
| Medium       | Medium       | Medium       | Medium       | Low       | Informational       |
| Low       | Medium/Low       | Medium       | Low       | Low       | Informational       |
| None       | Informational       | Informational       | Informational       | Informational       | Informational       |

In addition to Immunefi’s Vulnerability Severity Classification System, Polygon classifies vulnerabilities using the Common Vulnerability Scoring System (CVSS). In case of discrepancy, final determination is done by Polygon.

__Impacts to other assets__ 

Hackers are encouraged to submit issues outside of those outlined Impacts and Assets in Scope. 

If Whitehats can demonstrate a critical impact of code in production for an asset not in scope, Polygon Labs encourages you to submit your bug report using the “primacy of impact exception” asset as outlined below.

__Reward Distribution__

Please review how rewards are distributed based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2/). This is a simplified 5-level scale system with separate scales for Smart Contracts and Websites/Apps.

Payouts over the lower bound reward are directly related to the direct funds at risk. If no funds are at risk, the Critical or High payouts are limited to the minimum, unless decided otherwise by Polygon Labs.

For the purposes of clarification, funds at risk refer to the proof of loss of funds.

Rewards for critical Blockchain/DLT and smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 50 000__.

__Payouts and Payout Requirements__

Payouts are handled by the Polygon Labs team directly and are denominated in USD. Payouts are done in USDC or MATIC at the Polygon Labs teams' discretion. Polygon Labs commits to honoring payouts according to the terms set out in this program at the time of report submission, and to treat this program as the agreement and source of truth concerning bug reports and responsible disclosures. 

MATIC Payouts will be determined using TWAP 5 day price calculated from payment date.

Polygon Labs requires an invoice to be received for each payout. An invoice template can be provided by Polygon Labs.

This bug bounty program is only open to individuals who reside outside of the countries that are restricted by OFAC and by UNSC resolutions. If the individual is a US person, tax information may be required in order to properly issue a 1099.

For the purposes of determining report validity, this is a Primacy of Impact program. 

Learn more about report validity best practices here: [Best Practice - Primacy of Impact vs Primacy of Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/12340245635089-Best-Practices-Primacy-of-Impact). 

Polygon Labs requires an invoice to be received for each payout. An invoice template can be provided by Polygon Labs.

__KYC Requirements__

Polygon Labs does have a Know Your Customer (KYC) requirement for bug bounty payouts. 

| __KYC Info Required__     |
| ---------- |
| Wallet Address       |
| Passport (for Critical payouts)       |
| Place of residence (for Critical payouts)       |

KYC information is only required on confirmation of the validity of a bug report which Polygon Labs determines in its sole discretion.