Perpetual Protocol Bug Bounty Program - DropsEarn
Perpetual Protocol Bug Bounty Program

Perpetual Protocol Bug Bounty Program

    After the release of Perpetual Protocol on Ethereum and xDai mainnet, team are thrilled to reveal their bug bounty program with rewards up to 50,000 USD per bug found.

    Reward pool
    Expected profit
    Max participants
    DropsEarn score

  • Activity Type: Tasks Bug bounty
  • Date: 30 Dec 2020 12:00(UTC+3) - 31 Mar 2021 12:00(UTC+3)
  • Registration: Closed
  • Event status: You can't participate (Event ended)
  • Links: Official Announcement
Go to event page

Image for post

Detailed information 


Perpetual Protocol’s bug bounty program will pay out rewards based on the severity of the bugs found and the rewards will be denominated in PERP.

The level of severity and the reward for each submission is solely at the discretion of the Perpetual Protocol team. But as a rule of thumb, team follow OWASP risk rating methodology and estimate a bug’s severity based on

  1. The potential impact
  2. How likely an exploit will happen

Here are the severity levels and the respective payout:


  • Payout Range: 10,000–50,000 USD


  • Steal assets from the system
  • Permanently lock assets inside the system


  • Payout Range: 5,000–9,999 USD


  • Price manipulation to cause cascading liquidation


  • Payout Range: 1,000–4,999 USD


  • Manipulate or compromise price discovery


  • Payout Range: < 999 USD


The bug bounty covers the following smart contracts from the latest commit on the master branch of this Github repository:

  • RootBridge
  • ChainlinkL1
  • MetaTxGateway
  • ClientBridge
  • InsuranceFund
  • L2PriceFeed
  • ClearingHouse
  • Amm
  • ClearingHouseViewer
  • AmmReader


Please submit the full details of the vulnerability to with

  1. A title of Bugs Found
  2. The exact procedures or code required to reproduce the exploit

After receiving your submission, team will get back to you within 1~2 weeks on the eligibility and the exact rewards for the report.

Rules for the Program

  • Vulnerabilities that have been revealed from existing audit reports are not eligible for the bug bounty
  • Existing issues opened on the repository are not eligible for the bug bounty
  • Non-security related issues such as coding style and gas optimization are not eligible for the bug bounty
  • For the same vulnerability, the bounty will only go to the first reporter
  • Do not publicly share the vulnerability before it has been patched
  • Do not attempt to take advantage of the vulnerability
  • Paid auditors by the developers of the Perpetual Protocol are not eligible for the bounty