# Bug Bounty Program

## Overview 

The program covers Pact's Smart Contracts and Frontend / Backend vulnerabilities.  

## Rewards

| Severity | Payout            |
| -------- | ----------------- |
| Critical | up to 100 000 USD |
| High     | 25 000 USD        |
| Medium   | 5 000 USD         |

## Scope

All smart contract in our Github [repo](https://github.com/pactfi/algorand-testbed) are in scope. You can find them deployed on MainNet by checking our pools at <https://app.pact.fi>. PyTeal source code will be released in Q2/Q3 2022.

Our web app (<https://app.pact.fi>) and API (<https://api.pact.fi>) are also in scope.&#x20;

## Severity Classification

Bug bounty program use the [Immunefi Vulnerability Severity Classification System](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2/) with following exceptions.\
\
All critical payments, both for smart contracts and the website, are capped at 10% of economic damage.&#x20;

**Web vulnerabilities** in scope are those which lead directly and unequivocally to loss of user funds, such as by spoofing transactions on the Pact interface.

## Out of Scope & Rules

**All programs**

* Attacks that the reporter has already exploited himself, leading to damage
* Attacks that rely on social engineering
* Attacks requiring access to leaked keys/credentials
* Attacks already reported or published&#x20;

**Smart Contracts/Blockchain**

* Incorrect data supplied by third party oracles/exchange rate being outdated
  * Not to exclude oracle manipulation/flash loan attacks
* Basic economic governance attacks (e.g. 51% attack)
* Loss of positive slippage through Sandwich Attacks
* Lack of liquidity
* Best practice critiques
* Sybil attacks

**Websites and Apps**

* Any and all web vulnerabilities that do not directly lead to loss or permanent locking of user funds are out of scope

**The following activities are prohibited by bug bounty program:**

* Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
* Any testing with pricing oracles or third party smart contracts
* Attempting phishing or other social engineering attacks against our employees and/or customers
* Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
* Any denial of service attacks
* Automated testing of services that generates significant amounts of traffic
* Public disclosure of an unpatched vulnerability in an embargoed bounty

## Reporting

Email <bugbounty@pact.fi> with detailed description of the attack. All bug reports must come with a proof of concept.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.pact.fi/pact/security/bug-bounty-program.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.