Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.



All bug reports must come with a PoC in order to be considered for a reward.



Critical bug reports are capped at 10% of economic damage, primarily considering the funds at risk, and taking into account branding and PR issues, at the discretion of the team. However, rewards for Critical bug reports have a minimum reward of USD 50 000.



Payouts are handled by the Offchain Labs team directly and are denominated in USD. However, payouts are done in USDC.



Smart Contract