All code of thUSD can be found at https://github.com/Threshold-USD/dev/tree/thUSD
Documentation for the assets provided in the table can be found at [https://docs.threshold.network/applications/threshold-usd. ](https://docs.threshold.network/applications/threshold-usd)

Unless explicitly listed, only pages of the web/app assets in addition to the direct link are considered in-scope of the bug bounty program. Other subdomains are not considered as in-scope. However, for subdomain takeovers that lead to an impact on the in-scope asset, please refer to our page about [Reported Subdomain Takeovers.](https://immunefisupport.zendesk.com/hc/en-us/articles/14352199704593-Reported-Subdomain-Takeovers)

Threshold USD is a decentralized protocol that enables you to borrow thUSD, a stablecoin soft-pegged against USD and backed by ETH and tBTC as collaterals with a minimum collateral ratio of 110%.

Contract fails to deliver promised returns, but doesn't lose value

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds for more than 1 week

Injecting/modifying the static content on the target application without Javascript (Persistent) such as: HTML injection without Javascript, Replacing existing text with arbitrary text, Arbitrary file uploads, etc.

Subdomain takeover without already-connected wallet interaction

Smart contract unable to operate due to lack of token funds

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Unbounded gas consumption

Taking down the application/website

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Retrieve sensitive data/files from a running server such as: /etc/shadow, database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information, Commenting, Voting, Making trades, Withdrawals, etc.

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions

ThUSD Codebase

ThUSD Documentation

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System v2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). This is a simplified 4-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Public Disclosure of Known Issues__

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. 
- [https://github.com/Threshold-USD/dev/issues](https://github.com/Threshold-USD/dev/issues)
- [https://github.com/Threshold-USD/dev#known-issues](https://github.com/Threshold-USD/dev#known-issues)
- [https://github.com/liquity/dev/issues](https://github.com/liquity/dev/issues)
- [https://github.com/backstop-protocol/dev/blob/409ece756492f97197101c8266fdc025021caff6/README.md#pricefeed-limitations-and-known-issues](https://github.com/backstop-protocol/dev/blob/409ece756492f97197101c8266fdc025021caff6/README.md#pricefeed-limitations-and-known-issues)

__Previous Audits__

thUSD has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [Spearbit Audit Report](https://www.notion.so/thresholdnetwork/thUSD-Audit-Reports-f2ef9a35aa3142fe95a973c8f647faf0?pvs=4#b731738dfb064e4cb610aa3290448bb9)
- [Mixbytes for BAMM Contract Audit Report](https://www.notion.so/thresholdnetwork/thUSD-Audit-Reports-f2ef9a35aa3142fe95a973c8f647faf0?pvs=4#161ac08976a3405db14092c773476ea)
- [Mixbytes Audit Report - General ](https://www.notion.so/thresholdnetwork/thUSD-Audit-Reports-f2ef9a35aa3142fe95a973c8f647faf0?pvs=4#4e59a78ce65a47568cc27d2d1574bee3)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract - Critical
- Smart Contract - High
- Smart Contract - Medium
- Smart Contract - Low
- Web/App - Critical
- Web/App - High
- Web/App - Medium

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a complete PoC, when a PoC is required will not be provided with a reward.

__Other Terms and Information__

- Impacts only apply to assets in active use by the project, like contracts on mainnet or web/app assets used in production. Any impact that applies to assets not in active use, like test or mock files, are out-of-scope of the bug bounty program unless explicitly mentioned as in-scope.
- All reports must be submitted in English.
- Threshold USD would like to notify whitehats that payouts concerning high and critical reports may exceed the SLA established by Immunefi. These larger payouts could be delayed by a few hours or days, depending on the amount, to allow our governance process to fund the required payment, which can take up to 14 days. Threshold USD will inform the whitehat whenever this is the case, within the SLA timeframe, to manage expectations and provide clarity.

__Reward Payment Terms__

Payouts are handled by the thUSD team directly and are denominated in USD. However, payments are done in T ([https://www.coingecko.com/en/coins/threshold-network-token](https://www.coingecko.com/en/coins/threshold-network-token)). 

The calculation of the net amount rewarded is based on the average price between high and low for the day of the report submission as published on [CoinMarketCap.com](https://CoinMarketCap.com) Historical Data ([https://coinmarketcap.com/currencies/threshold/historical-data/](https://coinmarketcap.com/currencies/threshold/historical-data/)) for the T token. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price at the time of the bug report submission is USD 1.75 per token, then the reward will be 2857.142857 units of that token.

Rewards for critical smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 5 000__ and a max program cap of __USD 100 000__

Rewards for high smart contract bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 5 000__ and a max cap of __USD 10 000__

Rewards for critical web/app bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 5 000__ and a max cap of __USD 10 000__.

Rewards for high web/app bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of __USD 1 000__ and a max cap of __USD 5 000__.