Only the branches in the assets in scope table are considered as in-scope of the bug bounty program, but for the asset exceptions below in the Out of Scope & Rules section. All other branches, including the default branch are considered as out-of-scope. 

However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Sovryn is an on-chain decentralized trading and lending protocol deployed on RSK, a side chain of the Bitcoin blockchain-powered by merge-mining, and is governed by the community. The Sovryn protocol is controlled by its community and stakeholders. There is no single company, organization, or individual that represents or controls the Sovryn protocol.

Contract fails to deliver promised returns, but doesn't lose value

High Blockchain/DLT impact leading to direct economic damage

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Privilege escalation to access unauthorized functionalities

Taking Down the application/website

Any governance voting result manipulation

Smart contract unable to operate due to lack of token funds

Theft of gas

Unbounded gas consumption

Changing details of other users without direct financial impact (CSRF)

Third-Party API keys leakage that demonstrates loss of funds or modification on the website

Redirecting users to malicious websites (open redirect)

Stealing User Cookies

Subdomain Takeover without financial loss (applicable for subdomains with no addresses published)

Extract Sensitive data/files from the server with an impact on the system

Users Confidential information disclosure such as Email

Spoofing content on the target application (Persistent)

Critical Blockchain/DLT impact leading to direct economic damage

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Ability to execute system commands resulting in a financial loss

Extract Sensitive data/files from the server such as /etc/passwd resulting in a financial loss

Signing transactions for other users

Redirection of user deposits and withdrawals

Subdomain takeover resulting in financial loss (applicable for subdomains with addresses published)

Wallet interaction modification resulting in financial loss

Direct theft of user funds

Tampering with transactions submitted to the user’s wallet

Submitting malicious transactions to an already-connected wallet

Sovryn Smart Contracts

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All web/app bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required. In addition, Critical and High severity reports must come with a suggestion for a fix to be considered for a reward. 

Critical and High severity Solidity Contracts bug reports  must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code or pseudo code is required. In addition, Critical and High severity reports must come with a suggestion for a fix to be considered for a reward.

Rewards for critical smart contract and blockchain/DLT vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 50 000__ for Critical bug reports. 

For Blockchain/DLT infrastructure, only vulnerabilities that result in direct economic damage to yield will be considered as __High__, and only vulnerabilities that result in direct economic damage to principal funds will be considered as __Critical__.

Payouts are handled by the __Sovryn__ team directly and are denominated in USD. 50% of the payouts are done in __BTC__, and the other 50% is paid out in __SOV__ according to a 24 month vesting schedule (with monthly vesting).

| __Blockchain/DLT__     | __Payout__     |
| ---------- | ---------- |
| __Critical__       | Up to USD $1,000,000       |
| __High__       | USD $22,140       |

Sovryn

Codebase