Bug bounty / Coverage

1. Critical Level:

   • Up to $800,000 or 10% of the (potential) economic damage on contracts with more funds locked than 1 million USD.

   • The 10% rule also applies to funds already removed without authorization from respective contracts. In such cases, 90% of the funds must be immediately returned, and 10% can be kept as a Whitehat bounty reward.

   • The 10% rule can also be claimed as a general bug bounty on contracts above $1m TVL, by providing a PoC or by assisting the team in creating a PoC.

   Critical

   • 808,808 USDC maximum payout

   • 80,000 USDC minimum payout

   • Payout shall not exceed 10% of funds at risk at time of submission

   Severity Criteria

   Critical Definition

   • Definite and significant loss of funds without limitations of external conditions

   • Definite and significant freezing of funds for >1 year without limitations of external conditions

   General Notes

   • Sherlock’s Criteria for Issue Validity guide (used in Sherlock audit contests) can be a helpful resource for more context on out-of-scope issues, etc. but nothing in the guide should overrule the definitions above

   • A coded Proof of Concept (POC) with instructions to run the POC is required

   • If the protocol team has the ability to take measures (upgrade the contract, pause the contract, etc.) against an exploit, the potential damage is limited to a 1-hour exploit period before it is assumed that the protocol team takes measures to prevent further damage

   Platform Rules

   Please review the Sherlock Bug Bounty Platform Rules before submitting any vulnerability.

   Known Issues and Acceptable Risks

   • In the liquidation system, we allow liquidators to liquidate a user if they were insolvent before. The nonce should not be changed from that time (essentially, the user's positions should remain unchanged during this period). If the user adds funds to become solvent, the liquidator can still liquidate the user and return the extra funds.

   Previous Audits

   • https://audits.sherlock.xyz/contests/427

   • https://audits.sherlock.xyz/contests/144

   • https://audits.sherlock.xyz/contests/108

   • https://audits.sherlock.xyz/contests/85

   • Smart State

The 10% rule only applies for contracts that are live, and have a TVL more than $1M

1. High Level:

   • $50,000 or up to 1% of the (potential) economic damage.

   • The 10% rule, as outlined in the Critical Level section, also applies.

2. Medium Level:

   • USD $5,000 Payout.

   • Runnable PoC required.

3. Low Level:

   • USD $1,000 Payout.

   • Runnable PoC required.

Please note that for a Bug Bounty submission to be seen as critical the actual funds need to be able to be withdrawn by the Attacker from the system, that means the 12 hour withdrawal window has to be circumvented by the attacker, otherwise the submission would be counted as High.

Smart Contracts

Level	Impact
5. Critical	- Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - Permanent freezing of funds
4. High	- Theft of unclaimed yield - Theft of unclaimed royalties - Permanent freezing of unclaimed yield - Permanent freezing of unclaimed royalties - Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
3. Medium	- Block stuffing for profit - Unbounded gas consumption - Temporary freezing of funds
2. Low	- Contract fails to deliver promised returns, but doesn't lose value - Miner-extractable value (MEV)
1. None	- Best practices - Smart contract unable to operate due to lack of token funds

Payouts are handled by SYMMIO Team or DAO directly and are denominated in USDC or SYMM.

Payment in maximum 70% stable & minimum 30% native token.