All smart contracts of Zerion can be found at [https://github.com/zeriontech](https://github.com/zeriontech). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

At Zerion, we are on a mission to empower more people around the world with efficient, transparent, and censorship-resistant financial services. 

Theft and/or permanent freezing of assets

Any logic manipulation

Leak of user data

Deletion of user data

Redirected funds by address modification

Site goes down

Accessing sensitive pages without authorization

Users spoofing other users

Open redirects and modifying user’s vital information

Temporary freezing of funds for at least 1 hour

Injection of text

Unable to call smart contract

Unbounded gas consumption

Theft of gas

Redirecting users to malicious websites (open redirect)

Changing details of other users without direct financial impact (CSRF)

Third-Party API keys leakage that demonstrates loss of funds or modification on the website

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All web/app bug reports and Critical/High/Medium smart contract bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required. In addition, all Critical/High/Medium bug reports must come with a suggestion for a fix in order to be considered for a reward. 

The following known issues are considered to be out of scope of this bounty program: 
  - All issues highlighted previously in the following audit report: 
    - Peckshield Audit for DeFi SDK (August, 2020): [https://drive.google.com/file/d/158GG-J681xAc4d8pMibpP_SFJikX4HPM/view?usp=sharing](https://drive.google.com/file/d/158GG-J681xAc4d8pMibpP_SFJikX4HPM/view?usp=sharing)
    - Audit: [https://github.com/zeriontech/defi-sdk/blob/interactive/audits/Zerion%20DeFi%20SDK%20Trail%20of%20Bits%20Audit%20Report.pdf](https://github.com/zeriontech/defi-sdk/blob/interactive/audits/Zerion%20DeFi%20SDK%20Trail%20of%20Bits%20Audit%20Report.pdf)
  - External apps having integrations with Zerion

Rewards for critical smart contract vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 10 000__ for Critical bug reports. 

Critical website and application bug reports will be rewarded with the full __USD 15 000__ only if the impact leads to a direct loss in funds or a manipulation of the votes or the voting result, as well as the modification of its display leading to a misrepresentation of the result or vote. All other impacts that would be classified as Critical would be rewarded no more than __USD 10 000__.

Zerion requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is email address, full name, and country of residence.

Payouts are handled by the __Zerion__ team directly and are denominated in USD. However, payouts are done in __USDC or DAI__.

Zerion

Resources & Documentation