🐛Bug Bounty
Last updated
Last updated
We encourage the community to audit our open source code; we also encourage the responsible disclosure of any issues. The bug bounty program is intended to recognize the value of working with the community of independent security researchers and sets out our definition of good faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.
Pday offers substantial rewards for discoveries that can prevent the loss of assets, the freezing of assets, or harm to users.
To be eligible a bounty, a bug must have not been previously known by the Pday team or publicly disclosed by anyone. All Pday smart contracts and interactions (including bots and front end code) are in scope.
The amount of compensation will vary depending on bug severity. Reward amounts typically correspond to severity in the following manner. The reward currency can be discussed on a case by case basis.
| Severity | Reward |
|---|---|
Severity is calculated according to the OWASP risk rating model based on Impact and Likelihood.
Please DM your submissions on our social media channels or Telegram.
The submission must include clear and concise steps to reproduce the discovered vulnerability. The following layout of the bug bounty report is encouraged:
Description: Describe at a high level the bug with links to problematic code
Attack: Detailed instructions for exploiting the bug
Mitigation: How to resolve the bug
Suggested risk rating: The recommended severity of this bug
Low
$250
Medium
$1,000
High
$10,000
Critical
0-10% of funds at risk
