Velodrome Finance is a revolutionary new AMM based on Solidly launched on Optimism. The Optimism Foundation is excited to announce its latest bug bounty matching program, specifically designed for Velodrome Finance - a next-generation AMM that combines the best of Curve, Convex and Uniswap, designed to serve as Optimism's central liquidity hub. 

Contract fails to deliver promised returns, but doesn't lose value

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds

Temporary freezing NFTs

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Permanent freezing of funds

Permanent freezing of NFTs

Unauthorized minting of NFTs

Predictable or manipulable RNG that results in abuse of the principal or NFT

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Protocol insolvency

Velodrome Finance Codebase

Velodrome Finance Documentation

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Reward Calculation for Critical Level Reports__

For critical Smart Contract bugs, the reward amount is 20% of the funds directly affected up to a maximum of USD $100,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD $50,000 is to be rewarded in order to incentivize security researchers against withholding a bug report.   

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 1800 blocks the attack needs for subsequent attacks from the first attack, rounded down. 

__Reward Calculation for High Level Reports__

High smart contract vulnerabilities will be capped at up to 100% of the funds affected. In the event of temporary freezing, the reward doubles for every additional 30 blocks that the funds or NFTs could be temporarily frozen, rounded down to the nearest multiple of 30, up to the hard cap of USD $20,000.

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract, Critical
- Smart Contract, High
- Smart Contract, Medium
- Smart Contract, Low

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

As part of the bug bounty matching program, Optimism will contribute __152,500__ OP tokens to match the rewards offered by Velodrome. This means that for every reward paid out by Velodrome to a security researcher, Optimism will provide an additional, matching reward, in OP tokens. The total reward pool for this program is __152,500__ OP tokens

Payouts are handled by the Velodrome Finance team directly and are denominated in USD. However, payments are done in USDC and OP. The payment scheme involves three forms of currency: USD Coin (USDC), Velodrome Token (VELO), and Optimism Token (OP). 50% of the total payout is made in USD Coin or VELO and the remaining 50% of the payout is made in OP.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price is USD 1.75 per token, then the reward will be 2857.142857 units of that token.