> For the complete documentation index, see [llms.txt](https://docs.megapot.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.megapot.io/appendix/bug-bounty.md).

# Bug Bounty Program

Megapot is committed to the security of our protocol and the safety of user funds. We invite security researchers to help identify vulnerabilities in our smart contracts through our bug bounty program.

{% hint style="info" %}
Review our [Security policy](/appendix/security.md) for PGP key, safe harbor terms, and general reporting guidelines.
{% endhint %}

***

## Program Overview

| Detail                 | Value                                          |
| ---------------------- | ---------------------------------------------- |
| **Maximum Reward**     | $50,000 USDC                                   |
| **Reward Calculation** | 10% of funds at risk, capped per severity tier |
| **Platform**           | Self-administered (submit via email)           |
| **Scope**              | Smart contracts deployed on Base               |

***

## Rewards by Severity

Rewards are based on the [Immunefi Vulnerability Severity Classification System v2.3](https://immunefi.com/severity-system/), which prioritizes the impact of successful exploits.

| Severity     | Impact                                                                    | Reward Range      |
| ------------ | ------------------------------------------------------------------------- | ----------------- |
| **Critical** | Direct theft of funds, permanent freezing of funds, protocol insolvency   | $25,000 – $50,000 |
| **High**     | Theft of unclaimed yield, temporary freezing of funds                     | $2,500 – $25,000  |
| **Medium**   | Unbounded gas consumption, contract unable to operate due to logic errors | $100 – $2,500     |

### Critical Severity Examples

* Direct theft of LP deposits or player funds
* Manipulation of drawing outcomes or winning numbers
* Unauthorized minting or transfer of ticket NFTs
* Exploiting the entropy provider to predict or influence randomness

### High Severity Examples

* Theft of unclaimed referral fees or winnings
* Temporary freezing of LP withdrawals beyond the normal settlement period
* Manipulation of share calculations to extract excess value

### Medium Severity Examples

* Unbounded loops or storage operations that cause non-purchase transactions to exceed block gas limits
* Logic errors that prevent contract functionality without fund loss
* Theoretical governance parameterizations that could lead to protocol degradation

### Low Severity Examples

* Minor calculation errors that don't result in fund loss
* UI/contract state inconsistencies

***

## In-Scope Assets

All smart contracts deployed on **Base** (Chain ID: 8453) are in scope:

| Contract                          | Address                                                                                                                 | Category |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------- |
| Jackpot                           | [`0x3bAe643002069dBCbcd62B1A4eb4C4A397d042a2`](https://basescan.org/address/0x3bAe643002069dBCbcd62B1A4eb4C4A397d042a2) | Core     |
| JackpotLPManager                  | [`0xE63E54DF82d894396B885CE498F828f2454d9dCf`](https://basescan.org/address/0xE63E54DF82d894396B885CE498F828f2454d9dCf) | Core     |
| JackpotTicketNFT                  | [`0x48FfE35AbB9f4780a4f1775C2Ce1c46185b366e4`](https://basescan.org/address/0x48FfE35AbB9f4780a4f1775C2Ce1c46185b366e4) | Core     |
| JackpotAutoSubscription           | [`0x02A58B725116BA687D9356Eafe0fA771d58a37ac`](https://basescan.org/address/0x02A58B725116BA687D9356Eafe0fA771d58a37ac) | Helper   |
| BatchPurchaseFacilitator          | [`0x01774B531591b286b9f02C6Bc02ab3fD9526Aa76`](https://basescan.org/address/0x01774B531591b286b9f02C6Bc02ab3fD9526Aa76) | Helper   |
| TicketAutoCompoundVault           | [`0x3E22Ea60A1206A4BfEefBCff04D5E9d0A2D9B3Fc`](https://basescan.org/address/0x3E22Ea60A1206A4BfEefBCff04D5E9d0A2D9B3Fc) | Helper   |
| JackpotRandomTicketBuyer          | [`0xb9560b43b91dE2c1DaF5dfbb76b2CFcDaFc13aBd`](https://basescan.org/address/0xb9560b43b91dE2c1DaF5dfbb76b2CFcDaFc13aBd) | Helper   |
| GuaranteedMinimumPayoutCalculator | [`0x97a22361b6208aC8cd9afaea09D20feC47046CBD`](https://basescan.org/address/0x97a22361b6208aC8cd9afaea09D20feC47046CBD) | Internal |
| ScaledEntropyProvider             | [`0x5D030DEC2e0d38935e662C0d2feD44B050c8Ae51`](https://basescan.org/address/0x5D030DEC2e0d38935e662C0d2feD44B050c8Ae51) | Internal |

***

## Out of Scope

The following are **not eligible** for rewards:

* **Previously reported issues**: Vulnerabilities already submitted or identified in prior audits ([Zellic](https://github.com/coordinationlabs/megapot-v2-audit-reports/tree/main/zellic), [Code4rena](https://github.com/coordinationlabs/megapot-v2-audit-reports/blob/main/code4rena/))
* **Third-party dependencies**: Issues in external contracts (Pyth Network, USDC, etc.) not deployed by Megapot
* **Frontend/web application**: Vulnerabilities in megapot.io website or API
* **Theoretical vulnerabilities**: Issues without a working proof of concept
* **Best practices**: Gas optimizations, code style, or informational findings
* **Known limitations**: Documented protocol mechanics (e.g., LP withdrawal timing, drawing locks)
* **Social engineering**: Phishing, social engineering, or physical attacks
* **Griefing and denial of service**: Attacks requiring excessive capital or transactions with no economic benefit to the attacker, including known griefing vectors documented in prior audits

***

## Submission Requirements

### Required Information

All submissions must include:

1. **Description**: Clear explanation of the vulnerability
2. **Impact assessment**: What can an attacker achieve? What funds are at risk?
3. **Proof of Concept**: Working exploit code or detailed reproduction steps
4. **Affected contracts**: Specific contract addresses and functions
5. **Suggested fix** (optional): Recommended remediation approach

### Submission Process

1. **Email**: Send your report to **<security@megapot.io>**
2. **Encryption**: Use our [PGP key](/appendix/security.md#pgp-key) for sensitive reports
3. **Subject line**: `[BUG BOUNTY] Brief description of vulnerability`
4. **Response time**: We will acknowledge receipt within 24 hours

### Report Format

```
## Summary
[One paragraph describing the vulnerability]

## Severity
[Critical / High / Medium / Low]

## Affected Contracts
- Contract name: [address]
- Function(s): [function names]

## Impact
[Detailed description of what an attacker can achieve]

## Proof of Concept
[Code, transaction sequence, or detailed steps to reproduce]

## Recommended Fix
[Optional: your suggested remediation]
```

***

## Disclosure Policy

### Coordinated Disclosure

We practice coordinated disclosure to protect users:

| Phase                  | Timeline                                      |
| ---------------------- | --------------------------------------------- |
| **Acknowledgment**     | Within 24 hours of submission                 |
| **Initial assessment** | Within 5 business days                        |
| **Fix development**    | Up to 90 days, depending on severity          |
| **Reward decision**    | Within 14 days of fix deployment              |
| **Public disclosure**  | After fix is deployed and users are protected |

### Confidentiality

* **Do not** disclose the vulnerability publicly until we confirm the fix is deployed
* **Do not** share details with third parties without our written consent
* Premature disclosure will result in forfeiture of the bounty and potential legal action

### Researcher Recognition

With your permission, we will publicly acknowledge your contribution:

* Listed in our security acknowledgments
* Optional: credited in the fix commit or security advisory

***

## Safe Harbor

Megapot commits to the following for good-faith security research:

### Legal Protection

We will not initiate legal action against researchers who:

* Act in good faith to avoid privacy violations, destruction of data, and service interruption
* Only interact with accounts you own or with explicit permission of the account holder
* Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
* Report vulnerabilities promptly and provide reasonable time for remediation
* Do not engage in extortion or threats

### Authorized Testing

Good-faith security research under this policy is considered **authorized conduct**. We will not pursue civil or criminal action, or support prosecution by others, for accidental, good-faith violations of this policy.

### Testing Guidelines

**Allowed:**

* Testing on local forks or testnets
* Interacting with your own accounts on mainnet
* Reading public contract state

**Not Allowed:**

* Testing on mainnet with other users' funds
* Any action that could harm real users or their funds
* Interfering with live drawings or settlements
* Denial of service attacks against production infrastructure

***

## Eligibility

To be eligible for a reward, you must:

* Not be a current or former employee, contractor, or auditor of Megapot or Coordination, Inc.
* Not have previously reported the same vulnerability
* Comply with all testing and disclosure guidelines
* Complete KYC verification before payout (required for rewards over $1,000)
* Provide a valid wallet address for USDC payment on Base

***

## Reward Determination

### Factors Affecting Rewards

Rewards are determined by the Megapot security team based on:

| Factor                | Impact on Reward                                                             |
| --------------------- | ---------------------------------------------------------------------------- |
| **Severity**          | Primary factor; see severity tiers above                                     |
| **Funds at risk**     | 10% of realistically exploitable funds, capped by tier                       |
| **Quality of report** | Clear PoC and detailed writeup may increase reward                           |
| **Novelty**           | First reporter receives full reward; duplicates receive partial or no reward |
| **Fix complexity**    | Complex fixes requiring protocol changes may warrant higher rewards          |

### Reward Process

1. **Validation**: We verify the vulnerability is real and in scope
2. **Severity assessment**: We classify the severity based on impact
3. **Fix development**: We develop and test a fix
4. **Reward calculation**: We determine the reward based on the factors above
5. **Payout**: Reward paid in USDC on Base within 14 days of fix deployment

### Disputes

If you disagree with our severity assessment or reward decision, you may request a review. Send your appeal to **<security@megapot.io>** with additional context. Our decision after review is final.

***

## Contact

| Method            | Details                                              |
| ----------------- | ---------------------------------------------------- |
| **Email**         | <security@megapot.io>                                |
| **Response time** | 24 hours for initial acknowledgment                  |
| **PGP key**       | See [Security policy](/appendix/security.md#pgp-key) |

For general support or non-security issues, contact <team@megapot.io>.