Only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Symbiosis is a cross-chain engine and interchain communication Protocol. Our know-how — any to any token swaps regardless of the blockchain networks, both EVM and non-EVM supported. 

Direct theft of any user funds (ERC-20 tokens), whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds (ERC-20 tokens)

Symbiosis Codebase

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported. 

All Critical severity bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required. In addition, all Critical severity bug reports must also come with a suggestion for a fix to be considered for a reward. 

All known issues previously highlighted in the following audit reports are considered out of scope: 
  - [https://github.com/symbiosis-finance/audits](https://github.com/symbiosis-finance/audits) 

Payouts are handled by the __Symbiosis__ team directly and are denominated in USD. However, payouts are done in __USDT__(ERC20), __USDT__(BEP20), __USDC__(ERC20) or __USDC__(Polygon), at the discretion of the bug report submitter.