RootstockLabs

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3.

Reward Calculation for Critical Level Reports

For critical Blockchain/DLT bugs on HSM Firmware , the reward amount is 10% of the funds directly affected, capped at the maximum critical reward USD 200 000. However, a minimum reward of USD 20 000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

For critical Blockchain/DLT on HSM Firmware bugs with a non-funds-at risk impact, the reward will be paid out as follows:

• Network not being able to confirm new transactions (total network shutdown) USD 20 000
• Unintended permanent chain split requiring hard fork (network partition requiring hard fork) USD 20 000
• Permanent freezing of funds (fix requires hardfork) USD 20 000
• Permanent remote disruption of the HSM device or middleware USD 20 000

For critical Blockchain/DLT bugs on powpeg-node and rskj , the reward amount is 10% of the funds directly affected, capped at the maximum critical reward USD 50 000. However, a minimum reward of USD 10 000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

For critical Blockchain/DLT bugs with a non-funds-at risk impact, the reward will be paid out as follows:

• Network not being able to confirm new transactions (total network shutdown) USD $10 000
• Unintended permanent chain split requiring hard fork (network partition requiring hard fork) USD $10 000
• Permanent freezing of funds (fix requires hardfork) USD $10 000

For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 100 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 10 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

For critical web/apps bugs, reports will be rewarded with USD 10 000, only if the impact leads to:

• A loss of funds involving an attack that does not require any user action
• Private key or private key generation leakage leading to unauthorized access to user funds

All other impacts that would be classified as Critical would be rewarded a flat amount of USD 5 000. The rest of the severity levels are paid out according to the Impact in Scope table.

Repeatable Attack Limitations

• If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward.
• The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [150 blocks] the attack needs for subsequent attacks from the first attack, rounded down.

Reward Calculation for High Level Reports

For high Blockchain/DLT non-funds-at risk impacts, the reward will be paid out as follows:

• Unintended chain split (network partition) USD 5 000 for powpeg-node and rskj and USD 10 000 for HSM Firmware
• Temporary freezing of network transactions by delaying one block by 500% or more of the average block time of the preceding 24 hours beyond standard difficulty adjustments USD 5 000 for powpeg-node and rskj and USD 10 000 for HSM Firmware
• Causing network processing nodes to process transactions from the mempool beyond set parameters USD 5 000 for powpeg-node and rskj and USD 10 000 for HSM Firmware
• RPC API crash affecting projects with greater than or equal to 25% of the market capitalization on top of the respective layer USD 5 000 for powpeg-node and rskj and USD 10 000 for HSM Firmware
• Temporary remote disruption of the HSM device or middleware USD 10 000 for HSM Firmware

High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 5 000 to USD 10 000 with the reward calculated based on 100% of the funds at risk, though capped at the maximum high reward. In the event of temporary freezing, the reward doubles from the full frozen value for every additional 24h that the funds are temporarily frozen, up until a max cap of the high reward.

Reward Calculation for Medium Level Reports

For all Medium level bugs found on HSM Firmware, the reward will be USD 5 000. For Medium level bugs found on powpeg-node and rskj, the reward will be USD 2 500.

Reward Calculation for Low Level Reports

For all Low level bugs found on HSM Firmware, the reward will be USD 2 500. For Medium level bugs found on powpeg-node and rskj, the reward will be USD 1 000.

Reward Payment Terms

Payouts are handled by the RootstockLabs team directly and are denominated in USD. However, payments are done in USDC on ETH.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.