Timeless is a yield tokenization protocol where the yield tokens never expire and Bunni is a liquidity engine for incentivizing Uniswap v3 liquidity.

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Timeless and Bunni Codebase

Timeless and Bunni Documentation

__Reward Calculation for Critical Level Reports__

For critical Smart Contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 250,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 69,420 is to be rewarded in order to incentivize security researchers against withholding a bug report.   

__Reward Calculation for High Level Reports__

For high Smart Contract bugs, the reward amount is 100% of the funds directly affected up to a maximum of USD 25,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 10,000 is to be rewarded in order to incentivize security researchers against withholding a bug report.

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 5 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 5 blocks and then a third at 10 blocks, the funds at risk would be counted at 75% and 50% of the reward from the first attack, respectively.

__Reward Calculation for High Level Reports__

High smart contract vulnerabilities will be capped at up to 100% of the funds affected. In the event of temporary freezing, the reward doubles for every additional 5 blocks that the funds or NFTs could be temporarily frozen, rounded down to the nearest multiple of 5, up to the hard cap of USD 25,000. However, a minimum reward of USD 10,000 is to be rewarded in order to incentivize security researchers against withholding a bug report.   

__Previous Audits__

- [https://reports.yaudit.dev/reports/08-2022-Bunni/ ](https://reports.yaudit.dev/reports/08-2022-Bunni/)
- [https://reports.yaudit.dev/reports/03-2022-Bunni-Zap/ ](https://reports.yaudit.dev/reports/03-2022-Bunni-Zap/)
- [https://reports.yaudit.dev/reports/08-2022-Timeless-Yield-Daddy/ ](https://reports.yaudit.dev/reports/08-2022-Timeless-Yield-Daddy/)
- [https://github.com/spearbit/portfolio/blob/master/pdfs/Timeless-Spearbit-Security-Review.pdf](https://github.com/spearbit/portfolio/blob/master/pdfs/Timeless-Spearbit-Security-Review.pdf) 

Timeless and Bunni have provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [https://reports.yaudit.dev/reports/08-2022-Bunni/ ](https://reports.yaudit.dev/reports/08-2022-Bunni/)
- [https://reports.yaudit.dev/reports/03-2022-Bunni-Zap/ ](https://reports.yaudit.dev/reports/03-2022-Bunni-Zap/)
- [https://reports.yaudit.dev/reports/08-2022-Timeless-Yield-Daddy/ ](https://reports.yaudit.dev/reports/08-2022-Timeless-Yield-Daddy/)
- [https://github.com/spearbit/portfolio/blob/master/pdfs/Timeless-Spearbit-Security-Review.pdf ](https://github.com/spearbit/portfolio/blob/master/pdfs/Timeless-Spearbit-Security-Review.pdf)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract, Critical Severity Level
- Smart Contract, High Severity Level 

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the Timeless and Bunni team directly and are denominated in USD. However, payments are done in USDC.

Title	Description	Link
Timeless and Bunni Codebase	Program Codebase
Timeless and Bunni Codebase	Program Codebase

Title	Description	Link
Timeless and Bunni Documentation	Program Documentation
Timeless and Bunni Documentation	Program Documentation