All smart contracts of Autonolas can be found at

- [https://github.com/valory-xyz/autonolas-governance/tree/v1.2.2](https://github.com/valory-xyz/autonolas-governance/tree/v1.2.2)
- [https://github.com/valory-xyz/autonolas-registries/tree/v1.2.2](https://github.com/valory-xyz/autonolas-registries/tree/v1.2.2) 
- [https://github.com/valory-xyz/autonolas-tokenomics/tree/v1.2.2](https://github.com/valory-xyz/autonolas-tokenomics/tree/v1.2.2) 

However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds for more that 7 days

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption (Only governance related contracts are in scope for this kind of vulnerability, i.e. OLAS, Timelock, veOLAS, wveOLAS, Governor OLAS, Vote Weighting, FxGovernorTunnel, HomeMediator, OptimismMessenger, WormholeMessenger)

Smart contract fails to deliver promised returns, but doesn’t lose value

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported.

Critical and high smart contract vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the discretion of the team. However, there is a minimum reward of __USD 6 000__ for high smart contract vulnerabilities and __12 000__ for critical ones.

All Critical, High, and Medium Smart Contract bug reports must come with a PoC, have an end-effect impact, and an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

The following vulnerabilities are not eligible for a reward:

  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-governance/tree/main/audits](https://github.com/valory-xyz/autonolas-governance/tree/main/audits) 
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-governance/tree/main/docs](https://github.com/valory-xyz/autonolas-governance/tree/main/docs) 
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-governance/tree/main/test](https://github.com/valory-xyz/autonolas-governance/tree/main/test)
  - All vulnerabilities mentioned in the comments on the contracts code [https://github.com/valory-xyz/autonolas-governance/tree/main/contracts](https://github.com/valory-xyz/autonolas-governance/tree/main/contracts)
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-registries/tree/main/audits](https://github.com/valory-xyz/autonolas-registries/tree/main/audits) 
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-registries/tree/main/docs ](https://github.com/valory-xyz/autonolas-registries/tree/main/docs)
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-registries/tree/main/test ](https://github.com/valory-xyz/autonolas-registries/tree/main/test)
  - All vulnerabilities mentioned in the comments on the contracts code [https://github.com/valory-xyz/autonolas-registries/tree/main/contracts](https://github.com/valory-xyz/autonolas-registries/tree/main/contracts)
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-tokenomics/tree/main/audits ](https://github.com/valory-xyz/autonolas-tokenomics/tree/main/audits)
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-tokenomics/tree/main/docs ](https://github.com/valory-xyz/autonolas-tokenomics/tree/main/docs)
  - All vulnerabilities mentioned in [https://github.com/valory-xyz/autonolas-tokenomics/tree/main/test ](https://github.com/valory-xyz/autonolas-tokenomics/tree/main/test)
  - All vulnerabilities mentioned in the comments on the contracts code [https://github.com/valory-xyz/autonolas-tokenomics/tree/main/contracts](https://github.com/valory-xyz/autonolas-tokenomics/tree/main/contracts) 
  - All vulnerabilities found in the inherited source code from OpenZeppelin ([https://github.com/OpenZeppelin/openzeppelin-contracts](https://github.com/OpenZeppelin/openzeppelin-contracts)) and Solmate ([https://github.com/transmissions11/solmate](https://github.com/transmissions11/solmate))
  - All vulnerabilities found in the inherited source code for the bridging contracts from [Polygon](https://github.com/maticnetwork), [Gnosis](https://docs.gnosischain.com/bridges/tokenbridge/amb-bridge), [Arbitrum](https://docs.arbitrum.io/), [Optimism](https://docs.optimism.io/), [Base](https://docs.base.org/), [Wormhole](https://docs.wormhole.com/) docs.
  - All vulnerabilities found in code based on or inspired by Maple Finance ([https://github.com/maple-labs](https://github.com/maple-labs)) Curve DAO [https://github.com/curvefi/curve-dao-contracts](https://github.com/curvefi/curve-dao-contracts) Uniswap Labs [(https://github.com/Uniswap/v2-core)](https://github.com/Uniswap/v2-core), PaulRBerg [(https://github.com/paulrberg/prb-math)](https://github.com/paulrberg/prb-math), Jeiwan [(https://github.com/Jeiwan/zuniswapv2)](https://github.com/Jeiwan/zuniswapv2), Safe Ecosystem [(https://github.com/safe-global/safe-contracts)](https://github.com/safe-global/safe-contracts) and that are already reported to one of those projects.
  - All vulnerabilities that arise from misconfigured registration from users (e.g. component owners, agent owners, service owners, agents operators) or misuse of the registration logic (e.g. accidental locking of funds, loss of keys to control services, etc.).  

Autonolas requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an invoice with Name, Address, and Country of the hacker or a legal entity used for transactions. If the hacker is based in Switzerland they need to account for VAT in the invoice.
The collection of this information will be done by the Autonolas team. 

Payouts are handled by the __Autonolas__ team directly and are denominated in USD. However, payouts are done in __USDT and USDC__, with the choice of the ratio at the discretion of the team.

Autonolas

Resources & Documentation