All code of Yamato Protocol can be found at [https://github.com/yamatoprotocol/core/tree/master/contracts. ](https://github.com/yamatoprotocol/core/tree/master/contracts) Documentation for the assets provided in the table can be found at [https://docs.yamato.fi/. ](https://docs.yamato.fi/)

Other helpful links include:
- [https://github.com/yamatoprotocol/core/blob/master/README.md](https://github.com/yamatoprotocol/core/blob/master/README.md)


Yamato Protocol is a simple overcollateralized stabled token issuing Dapp with minimal governance (variables).

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Previous Audits__

Yamato Protocol has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [https://blockapex.io/yamato-stablecoin-lending-audit-report/](https://blockapex.io/yamato-stablecoin-lending-audit-report/)
- [https://blockapex.io/yamato-protocol-audit-report/](https://blockapex.io/yamato-protocol-audit-report/)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Smart Contract - Critical
- Smart Contract - High

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the Yamato Protocol team directly and are denominated in USD. However, payments are done in ETH, USDC, USDT and/or crvUSD. Researchers will be able to request which token they prefer to be paid. 

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price is USD 1.75 per token, then the reward will be 2857.142857 units of that token.
