Pertaining to Mars Outposts which are are deployed on the Osmosis and Neutron blockchains

Assets in scope are as follows: 
  - Osmosis Mars Outpost contracts
  - Neutron Mars Outpost contracts

Mars Outposts related smart contracts deployed onto the Osmosis and Neutron blockchains can be found at [https://github.com/mars-protocol/contracts](https://github.com/mars-protocol/contracts).

If an impact can be caused to any other asset managed by Mars Hub or its Osmosis outpost,that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for consideration by the project.

Mars Protocol consists of a money market, called Red Bank, and a generalized credit primitive called Credit Accounts. Mars Protocol utilizes a so-called hub and outpost topology, whereby its base, Mars Hub - - which is an instance of DAO on Neutron is the command center for Mars outposts. Each outpost can consist of instances of Red Bank and/or Credit Accounts.

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Protocol insolvency

Oracle manipulation and flash loan attacks

Theft of unclaimed royalties

Freezing of funds

Freezing of NFTs (applicable for v2-fields-of-mars/rover only)

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Freezing of unclaimed yield

Freezing of unclaimed royalties

Unintended consequences from Maximal-extractable value (MEV) exploration

Rewards are distributed according to the impact of the vulnerability based on the [ImmuneFi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2/). This is a simplified 5-level scale, with separate scales for websites/apps, smart contracts, and blockchains/DLTs, focusing on the impact of the vulnerability reported. 

All bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

Rewards for critical smart contract vulnerabilities are further capped at 10% of mainnet economic damage potentially caused. However, there is a minimum reward of __USD 20 000__ and a maximum reward of __USD 100 000__. 

All issues highlighted in the following audit reports are considered out of scope of the program: 
- [Audits reports for Mars Hub, Periphery contracts and the Mars outposts](https://github.com/mars-protocol/mars-audits)

__Reward Payment Terms__

Payouts are handled by the Mars Protocol Foundation and are denominated in USD. However, payouts are done in MARS.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Mars Protocol

Resources & Documentation