This bug bounty program applies only for Tinyman v1.1 contracts which includes validator approval, validator clear state and pool logic sig (stateless) programs. The Pool accounts are LogicSignature Contract accounts. The unique LogicSignature contract for each is generated from [pool_logicsig.teal.tmpl](https://github.com/tinymanorg/tinyman-contracts-v1/blob/8be3e7f8005bb131c51e10e82885a8e764d7a336/contracts/pool_logicsig.teal.tmpl). It does not exist on-chain.

Tinyman is a decentralised exchange (DEX) on Algorand. More specifically, it is an Automated Market Maker (AMM) exchange employing the Constant Product Market Maker algorithm.

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Modification/deletion of Validator App

Taking signer authority of pool accounts

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of funds

Smart contract unable to operate due to lack of token funds

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Making pool accounts pay unnecessary fees

Contract fails to deliver promised returns, but doesn't lose value

Bootstrapping a pool with incorrect Pool Token properties

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System](https://immunefi.com/severity-updated). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

No PoC is required, but all bug reports must be detailed with either step-by-step exploit instructions or pointers to specific lines of code in order to be considered for a reward. The Tinyman team may ask for further explanations for bug reports to prove validity. 

Tinyman will also issue an NFT reward for valid High severity reports, and a single edition Tinyman NFT reward for valid Critical severity reports.

The following impacts are considered to be out of scope of this bug bounty program: 
  - Issues due to Freeze or Clawback of pooled assets
  - Rounding issues when swapping/minting/burning with <1000 microunits of an asset
  - Overflow errors when attempting to swap/mint/burn very large amounts 
  - Attacks against accounts not created from the Pool LogicSig Template
  - MEV style attacks
  - Pool ratio/price manipulation due to donations to the pool account

All known issues listed here are also considered as out-of-scope of the bug bounty program: [https://github.com/tinymanorg/docs/tree/main/known-issues](https://github.com/tinymanorg/docs/tree/main/known-issues).   

Payouts are handled by the __Tinyman__ team directly and are denominated in USD. However, payouts are done in __USDC__ or __ALGO__, at the discretion of the team.

Tinyman

Resources & Documentation