Though only the proxy contracts are listed as in-scope, current implementation and any further updates to the implementation contracts are considered in scope. When reporting a bug, please make sure to select the relevant proxy smart contract as the target.

All smart contracts of Toucan can be found at [https://github.com/ToucanProtocol/contracts](https://github.com/ToucanProtocol/contracts). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Toucan is building technology to finance climate action at scale. They are developing infrastructure to move carbon credits onto open blockchains, which helps make carbon markets more transparent, efficient, accessible, and scalable. 

Direct theft of any funds belonging to specific users, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Permanent freezing of funds

Permanent freezing of NFTs

Unauthorized minting of NFTs or tokens

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Protocol insolvency

Obtaining admin access or any other privileged role which can lead to abuse of the protocol

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds for at least 24 hours

Temporary freezing NFTs for at least 24 hours

Deposits of TCO2s into pools that exclude these TCO2s

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Permanent or temporary freezing of any functionality for less than 24 hours

Permanent or temporary freezing of any functionality not captured above

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Rewards for critical smart contract vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 50 000__ and a maximum reward of __USD 200 000__.

Known issues highlighted in the following audit reports are considered out of scope: 
  - [https://byterocket.com/audit/toucan-protocol](https://byterocket.com/audit/toucan-protocol)
  - [https://byterocket.com/audit/toucan-protocol-nct](https://byterocket.com/audit/toucan-protocol-nct)
  - [https://byterocket.com/audit/toucan-protocol-retirement-certificates](https://byterocket.com/audit/toucan-protocol-retirement-certificates)

Payouts are handled by the __Toucan__ team directly and are denominated in USD. However, payouts are done in __USDC (ERC20)__.  All payouts require invoice with email and crypto wallet address.

Toucan

Resources & Documentation