Impacts only apply to assets in active use by the project like contracts on mainnet or web/app assets used in production. 

For GitHub repositories please ensure you are reviewing the latest published releases and not the default branch

Any impact that applies to assets not in active use, like test or mock files, are out-of-scope of the bug bounty program unless explicitly mentioned as in-scope. 

__Blockchain/DLT__ 

  - Blockchain/DLT - PoC, Blockchain/DLT bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

__Smart Contracts__ 

  - Smart Contracts - PoC, Smart Contract bug reports are to include a runnable Proof of Concept (PoC) in order to prove impact.  
  - For more information on PoCs please visit: [Proof of Concept (PoC) Guidelines and Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules)

__Dev Environment and Documentation__ 
Polygon Labs has included dev documentation and/or instructions to help in reviewing code and looking for bugs:

| Dev or Staging Environment Links    |
| ---------- |
| [https://wiki.polygon.technology/docs/zkEVM/develop/](https://wiki.polygon.technology/docs/zkEVM/develop/)        |

__Impacts to other assets__ 
Hackers are encouraged to submit issues outside of the outlined Impacts and Assets in Scope. 

If Whitehats can demonstrate a critical impact on code in production for an asset not in scope, Polygon Labs encourages you to submit your bug report using the “primacy of impact exception” asset.

Polygon zkEVM is the leading zero-knowledge scaling solution that is fully equivalent to an EVM. All existing smart contracts, developer toolings and wallets work seamlessly. Polygon zkEVM harnesses the power of zero-knowledge proofs in order to help reduce transaction costs and massively increase throughput, all while inheriting the security of Ethereum.

Unintended chain split (network partition)

Transient consensus failures

Temporary freezing of funds for at least 1 week

Theft of user fees

DoS and does not shut down the network

Theft of gas

Unbounded gas consumption

Network not being able to confirm new transactions (Total network shutdown requiring hard fork)

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hard fork)

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

(For Blockchain/DLTR and Smart Contracts Only) This program is considered to be governed by Primacy of Impact. For more information on what this means visit: [Best Practice - Primacy of Impact vs Primacy of Rules](https://immunefisupport.zendesk.com/hc/en-us/articles/12340245635089-Best-Practices-Primacy-of-Impact). 

__For fflonkVerififer Assets__

- To check latest verifier in scope used by each rollup, use [https://etherscan.io/address/0x5132A183E9F3CB7C848b0AAC5Ae0c4f0491B7aB2#readProxyContract](https://etherscan.io/address/0x5132A183E9F3CB7C848b0AAC5Ae0c4f0491B7aB2#readProxyContract) then get the verifier used by each rollup using `rollupIDToRollupData` for IDs ranging from 1 onwards. Then, the verifier contract will be part of the returning data.

__Impacts to other assets__ 

Hackers are encouraged to submit issues outside of those outlined Impacts and Assets in Scope. 

If Whitehats can demonstrate a critical impact of code in production for an asset not in scope, Polygon Labs encourages you to submit your bug report using the “primacy of impact exception” asset as outlined below. 

The final classification however takes into consideration the likelihood of the impact being achieved based on the table below. When submitting a bug report, select the original assigned impact level, but please be aware that its severity level may be reassigned based on the likelihood according to this table.

| Impact \ Likelihood     | Critical     | High     | Medium     | Low     | None     |
| ---------- | ---------- | ---------- | ---------- | ---------- | ---------- |
| Critical       | Critical       | Critical       | High       | Medium       | Informational       |
| High       | High       | High       | High       | Medium       | Informational       |
| Medium       | Medium       | Medium       | Medium       | Low       | Informational       |
| Low       | Medium/Low       | Medium       | Low       | Low       | Informational       |
| None       | Informational       | Informational       | Informational       | Informational       | Informational       |

In addition to Immunefi’s Vulnerability Severity Classification System, Polygon classifies vulnerabilities using the Common Vulnerability Scoring System (CVSS). In case of discrepancy, final determination is done by Polygon.

Please review how rewards are distributed based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). This is a simplified 4-level scale system with separate scales for Smart Contracts and Websites/Apps.

Payouts over the lower bound reward are directly related to the direct funds at risk. If no funds are at risk, the Critical or High payouts are limited to the minimum, unless decided otherwise by Polygon Labs.

For the purposes of clarification, funds at risk refer to the proof of loss of funds.

Rewards for critical blockchain/DLT and smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 50 000.

__Payouts and Payout Requirements__ 
Payouts are handled by the Polygon Labs team directly and are denominated in USD. Payouts are done in USDC or POL at the Polygon Labs teams' discretion. Polygon Labs commits to honoring payouts according to the terms set out in this program at the time of report submission, and to treat this program as the agreement and source of truth concerning bug reports and responsible disclosures. 

This bug bounty program is only open to individuals who reside outside of the countries that are restricted by OFAC and by UNSC resolutions. If the individual is a US person, tax information may be required in order to properly issue a 1099.

For the purposes of determining report validity, this is a Primacy of Impact program.

Learn more about report validity best practices here: [Best Practice - Primacy of Impact vs Primacy of Rules. ](https://immunefisupport.zendesk.com/hc/en-us/articles/12340245635089-Best-Practices-Primacy-of-Impact)

POL Payouts will be determined using TWAP 5 day price calculated from payment date.

Polygon Labs requires an invoice to be received for each payout. An invoice template can be provided by Polygon Labs.


__KYC Requirements__ 
Polygon Labs does have a Know Your Customer (KYC) requirement for bug bounty payouts. 

| KYC Info Required    |
| ---------- |
| Wallet Address    |
| Passport (for Critical payouts)    |
| Place of residence (for Critical payouts)    |

KYC information is only required on confirmation of the validity of a bug report which Polygon Labs determines in its sole discretion.