This bounty covers the following contracts listed in the [constants.ts](https://github.com/gnosis/zodiac/blob/master/src/factory/constants.ts) file in the Zodiac repo, deployed to any network with an officially supported deployment of the Gnosis Safe.

  - REALITY_ETH: 0x72d453a685c27580acDFcF495830EB16B7E165f8
  - REALITY_ERC20: 0x6f628F0c3A3Ff75c39CF310901f10d79692Ed889
  - BRIDGE: 0x457042756F2B1056487173003D27f37644C119f3
  - DELAY: 0xeD2323128055cE9539c6C99e5d7EBF4CA44A2485
  - FACTORY: 0x00000000000DC7F163742Eb4aBEf650037b1f588
  - EXIT_ERC20: 0x33bCa41bda8A3983afbAd8fc8936Ce2Fb29121da
  - EXIT_ERC721: 0xD3579C14a4181EfC3DF35C3103D20823A8C8d718
  - SCOPE_GUARD: 0xfDc921764b88A889F9BFa5Ba874f77607a63b832
  - CIRCULATING_SUPPLY_ERC20: 0xb50fab2e2892E3323A5300870C042B428B564FE3
  - CIRCULATING_SUPPLY_ERC721: 0x71530ec830CBE363bab28F4EC52964a550C0AB1E
  - ROLES: 0x85388a8cd772b19a468F982Dc264C238856939C9

All smart contracts of Zodiac can be found at [https://github.com/gnosis/zodiac](https://github.com/gnosis/zodiac). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.


The expansion pack for DAOs, Zodiac is a collection of tools built according to an open standard. The Zodiac open standard enables DAOs to act more like constellations, connecting protocols, platforms, and chains, no longer confined to monolithic designs.

Any governance voting result manipulation

Theft of user or DAO funds

Permanent freezing of user or DAO funds

Causing DAO to execute arbitrary code

Temporary freezing of user or DAO funds for at least 24 hours

Temporarily preventing the DAOs from executing approved proposal

Smart contract unable to operate due to lack of token funds

Griefing (e.g. no profit motive for an attacker, but damage to the users or the DAO)

Smart contract functionality significantly differs from how it is described in its official repo

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

All bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Rewards for critical smart contract vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of __USD 100 000__ for Critical smart contract bug reports.

Gnosis requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an invoice including:
  - Full Name or Business Name
  - Personal or Business Address
  - Invoice number
  - Invoiced amount and currency

Payouts are handled by the __Gnosis__ team directly and are denominated in USD. However, payouts are done in __ETH__, __DAI__ or __GNO__ at the discretion of the team. Payouts may be done on either Mainnet or the Gnosis chain.


Zodiac

Resources & Documentation