🐞Bug Bounty

S/O to AAVE for building such an epic standard for bug bounties (we forked it).

Overview

The security of SZNS users is paramount. For that reason, starting on August 10, 2022, the SZNS core smart contracts and Collection contracts are subject to the SZNS Protocol Bug Bounty (the “Program”). The Program enables community members to submit reports of “bugs” or vulnerabilities for a chance to earn rewards. The Program aims to incentivize responsible disclosure and enhance the security of SZNS.

Rewards will be allocated based on the severity of the bug disclosed and evaluated and rewarded up to USD $250,000.

The scope, terms and rewards at the sole discretion of the team (the “Team”).

Scope

The Program includes the vulnerabilities and bugs in SZNS smart contract and .

The following are not within the scope of the Program:

Bugs in any third party contract or platform that interacts with SZNS;

Vulnerabilities related to domains, DNS or servers of websites;

Vulnerabilities already reported and/or discovered in contracts built by third parties on SZNS;

Any already-reported bugs or other vulnerabilities.

Determinations of eligibility, score and all terms related to rewards and their payment are at the sole discretion of the Team.

Eligibility

To be eligible for a reward under this Program, you must:

Discover a previously unreported, non-public vulnerability within the scope of this Program. Vulnerabilities must be distinct from the issues covered in the previously conducted publicly available audits.

Be the first to disclose the unique vulnerability to the Team by the disclosure requirements below. If similar vulnerabilities are reported, the first submission shall be rewarded (if determined valid and otherwise in the scope of this Program).

Possess sufficient technical knowledge and provide sufficient information necessary to reproduce and fix the vulnerability.

Not engage in any unlawful conduct when disclosing the bug, including through threats, demands, or any other coercive tactics.

Not exploit the vulnerability in any way, including by making it public or obtaining a profit (other than a reward under this Program). Any publicity in any way, whether direct or indirect, relating to any bug or vulnerability will automatically disqualify it and you from the Program.

Make a good faith effort to avoid privacy violations, data destruction, interruption or degradation of SZNS.

Submit only one vulnerability per submission unless you need to chain vulnerabilities to impact any vulnerabilities. If you want to add more information to a provided issue, create a new submission referencing the initial one.

Not submit a separate vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program.

Not be one of our current or former employees, vendors, service providers, or contractors or an employee of any of those vendors or contractors or an immediate family (parent, sibling, spouse, or child) or household member of such person.

Not be subject to any international, national or state level sanctions.

Be at least 18 years of age or, if younger, submit your vulnerability with the consent of your parent or guardian.

Disclosure

Any vulnerability or bug discovered must be reported to the Team via [e-mail]. The disclosure must be made within 24 hours following the discovery of the vulnerability and, as noted above, not have been exploited in any way prior to disclosure or publicized or disclosed to any third party (other than the Team) prior to not only submission of the report, but also fixing of the bug / vulnerability.

Rewards

All submissions are evaluated by the Team on a case by case basis. Rewards are allocated based on the severity of the issue, and other variables, including, but not limited to a) the quality of the issue description, b) the instructions for reproducibility, and c) the quality of the fix (if included). A detailed report of a vulnerability increases the likelihood of a reward and may increase the reward amount. Therefore, please provide as much information about the vulnerability as possible.

The Program intends to follow a similar approach as the Ethereum Bug Bounty, where the severity of the issues will be based according to the OWASP risk rating model based on “Impact” and “Likelihood”. The evaluation on scoring is however at the sole discretion of the Team.

All rewards are paid in USDC or ETH equivalent via a transfer to the wallet address provided by the participant to the Team. The reward can be exchanged into other crypto assets or fiat. As a condition of participating in this Program, the participants give Company the permission to share their wallet address and other information provided by them to third parties for the purpose of administering this Program and complying with applicable laws, regulations, and rules.

The reward will be received in USDC token based on the following severity scheme:

Note = Up to 100 USDC

Very low = Up to 500 USDC

Low = Up to 1,000 USDC

Medium = Up to 5,000 USDC

High = Up to 10,000 USDC

Very High = Up to 50,000 USDC

Critical = Up to 250,000 USDC

Other terms

The decisions made regarding rewards are final and binding.

By submitting your report, you grant the Company any and all rights, including without limitation intellectual property rights, needed to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility for and amounts of the rewards and how such rewards will be paid, are made at sole discretion of the Company.

Terms and conditions of the Program may be altered at any time. Company may change or cancel this Program at any time, for any reason.