Web/App (applicable to latest release tag)

If an impact can be caused to any other asset managed by SORA that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for the consideration by the project.

The latest release tag for the asset “[https://github.com/sora-xor/polkaswap-exchange-web](https://github.com/sora-xor/polkaswap-exchange-web)“ can be found here - [https://github.com/sora-xor/polkaswap-exchange-web/tags](https://github.com/sora-xor/polkaswap-exchange-web/tags)

The SORA community envisions a new economic world order — one that is truly decentralized and democratic. SORA is building to deliver financial inclusion for all without discrimination and provide a better method to manage day-to-day finances.

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet, such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions, etc.

SORA Documentation

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate classifications for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All bug reports must come with a Proof of Concept (PoC) with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Payouts are handled by the __SORA__ team directly and are denominated in __USD__. However, payouts are done in __TBCD__ and can be vested with the choice of the ratio at the discretion of the team.