All smart contracts of rDEX can be found at [https://github.com/stafiprotocol/stafi-node/tree/rswap/node/pallets/rdex](https://github.com/stafiprotocol/stafi-node/tree/rswap/node/pallets/rdex). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

rDEX V1 is an AMM DEX developed by StaFi that seeks to solve the liquidity problems associated with rTokens, the staking derivatives issued by StaFi. It will provide decentralized transaction services for all rTokens based on the StaFi Chain. Being an important part of the StaFi rToken ecosystem, rDEX V1 now is deployed on the StaFi chain, which is Substrate-based.

Contract fails to deliver promised returns, but doesn't lose value

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Unbounded gas consumption

Theft of gas

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All bug reports must come with a suggestion for a fix to be considered for a reward. 

All known issues highlighted in the following audit report are considered out-of-scope:
  - [https://github.com/stafiprotocol/stafi-bootstrap/blob/master/audits/rdex/PeckShield-Audit-Report-Stafi-rDEX-v1.0.pdf](https://github.com/stafiprotocol/stafi-bootstrap/blob/master/audits/rdex/PeckShield-Audit-Report-Stafi-rDEX-v1.0.pdf)

Payouts are handled by the __StaFi__ team directly and are denominated in USD. However, payouts are done in __FIS__.

StaFi: rDEX