
Detailed information
Rewards
Perpetual Protocol’s bug bounty program will pay out rewards based on the severity of the bugs found and the rewards will be denominated in PERP.
The level of severity and the reward for each submission is solely at the discretion of the Perpetual Protocol team. But as a rule of thumb, team follow OWASP risk rating methodology and estimate a bug’s severity based on
- The potential impact
- How likely an exploit will happen
Here are the severity levels and the respective payout:
Critical:
- Payout Range: 10,000–50,000 USD
Examples:
- Steal assets from the system
- Permanently lock assets inside the system
High:
- Payout Range: 5,000–9,999 USD
Examples:
- Price manipulation to cause cascading liquidation
Medium:
- Payout Range: 1,000–4,999 USD
Examples:
- Manipulate or compromise price discovery
Low:
Scope
The bug bounty covers the following smart contracts from the latest commit on the master branch of this Github repository:
- RootBridge
- ChainlinkL1
- MetaTxGateway
- ClientBridge
- InsuranceFund
- L2PriceFeed
- ClearingHouse
- Amm
- ClearingHouseViewer
- AmmReader
Reporting
Please submit the full details of the vulnerability to help@perp.fi with
- A title of Bugs Found
- The exact procedures or code required to reproduce the exploit
After receiving your submission, team will get back to you within 1~2 weeks on the eligibility and the exact rewards for the report.
Rules for the Program
- Vulnerabilities that have been revealed from existing audit reports are not eligible for the bug bounty
- Existing issues opened on the repository are not eligible for the bug bounty
- Non-security related issues such as coding style and gas optimization are not eligible for the bug bounty
- For the same vulnerability, the bounty will only go to the first reporter
- Do not publicly share the vulnerability before it has been patched
- Do not attempt to take advantage of the vulnerability
- Paid auditors by the developers of the Perpetual Protocol are not eligible for the bounty