However, Superfluid also supports other networks: Ethereum mainnet, Gnosis Chain, Optimism, Arbitrum, Avalacne C, BSC, CELO, BASE. SCROLL.

Their addresses can be obtained from the tab at https://console.superfluid.finance/matic/protocol.

All smart contracts of Superfluid can be found at [https://github.com/superfluid-finance/protocol-monorepo/tree/dev/packages/ethereum-contracts/](https://github.com/superfluid-finance/protocol-monorepo/tree/dev/packages/ethereum-contracts/contracts). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Superfluid is an asset streaming protocol that has the power to describe cash flows and execute them automatically on-chain over time in a non-interactive way. Superfluid streams are programmable, composable, and modular. The first cash flow type allows constant streams of value and one-to-many distributions. All streams are settled at the same time, based on block timestamps.

Temporary freezing of funds (reproducible)

Temporary freezing of funds (non-reproducible)

Drainage of all user funds

Drainage of portion of user funds

These accepted impacts are then based on the severity classification system of this bug bounty program. When submitting a bug report, please select the severity level you feel best corresponds to the severity classification system as long as the impact is one of the listed items.

Superfluid smart contracts

Rewards are distributed according to the impact of the vulnerability based on the  [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Critical/High smart contract reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

This program has the following severity classification and reward structure. In cases where this conflicts with Immunefi’s own classification system, the structure below will be followed. 

Critical: Reward - USD 50 000 - USD 200 000
  - A reproducible vulnerability discovered in the core protocol that can be exploited by anyone that results in the loss of a portion or all user funds in the Superfluid protocol:
    - Critical bug which results in the drainage of all user funds (USD 200 000).
    - Critical bug which results in the drainage of a portion of user funds (USD 50 000 + 15% of user funds at risk or stuck, up to USD 200 000).

High: Reward - USD 10 000 - USD 50 000
  - A reproducible bug by anyone that results in the core protocol not functioning properly where funds are stuck. If funds are stuck: you get a base reward of USD 10 000 + 15% of the total amount of funds that are stuck.
    - If not reproducible (requires special conditions which can’t be affected by anyone): USD 10 000 + 7.5% of the total amount of funds that are stuck


The following known issues are considered to be out of scope: 
  - Gas griefing specifically by spam attacks 
  - Gas griefing specifically in SuperApp termination callbacks 

Rewards for critical vulnerabilities are further capped at 15% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 50 000__ for Critical bug reports. 

Superfluid requires bug bounty hunters to pass a successful KYC screening in order to be eligible for rewards. By submitting a report, bug bounty hunters agree to share the following information: Name, Surname, Address, Citizenship Country, and Wallet Address. The collection of this information will be done by Superfluid Finance Ltd.

Payouts are handled by __Superfluid__ directly and are denominated in USD. However, payouts are done in __USDC__.

Superfluid

Codebase