However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Sherlock is a risk management platform designed to provide DeFi protocols with affordable, reliable coverage against smart contract exploits starting from Day 1.

Temporary freezing of funds (greater than 1 month)

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Sherlock Smart Contracts

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

A PoC is required for Critical and High Smart Contract/Blockchain bug reports.

Exploits that result in a material loss of funds for users and is profitable for the hacker are classified as Critical. Anything else that results in a material loss/freezing of user funds that is unprofitable for the hacker is classified as High. 

Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of __USD 50 000__ for Critical bug reports. 

Known issues in their previous audits are considered out-of-scope: https://github.com/sherlock-protocol/sherlock-v2-core/tree/main/audits

Issues identified in previous audit reports may not be eligible for payout

To be eligible for reward, impact from table below must be demonstrated where all thefts must be profitable and all freezing must be reasonably priced for the impact.

Payouts are handled by the __Sherlock__ team directly and are denominated in USD. Payouts are done in __USDC__.

Sherlock

Codebase