Smart Contract Bug Bounty Program

This bug bounty program is no longer running. Submissions will not be addressed. The tables below are a historical record of rewards and scope while the program was active. Read Announcement.

Megapot previously ran a self-administered smart contract bug bounty. That program is closed. Do not send new reports.

---

Program Overview

Detail	Value
Maximum Reward	$50,000 USDC
Reward Calculation	10% of funds at risk, capped per severity tier
Platform	Self-administered (historical; program closed)
Scope	Smart contracts deployed on Base

---

Rewards by Severity

Rewards are based on the Immunefi Vulnerability Severity Classification System v2.3, which prioritizes the impact of successful exploits.

Severity	Impact	Reward Range
Critical	Direct theft of funds, permanent freezing of funds, protocol insolvency	$25,000 – $50,000
High	Theft of unclaimed yield, temporary freezing of funds	$2,500 – $25,000
Medium	Unbounded gas consumption, contract unable to operate due to logic errors	$100 – $2,500

Critical Severity Examples

• Direct theft of LP deposits or player funds
• Manipulation of drawing outcomes or winning numbers
• Unauthorized minting or transfer of ticket NFTs
• Exploiting the entropy provider to predict or influence randomness

High Severity Examples

• Theft of unclaimed referral fees or winnings
• Temporary freezing of LP withdrawals beyond the normal settlement period
• Manipulation of share calculations to extract excess value

Medium Severity Examples

• Unbounded loops or storage operations that cause non-purchase transactions to exceed block gas limits
• Logic errors that prevent contract functionality without fund loss
• Theoretical governance parameterizations that could lead to protocol degradation

Low Severity Examples

• Minor calculation errors that don’t result in fund loss
• UI/contract state inconsistencies

---

In-Scope Assets

All smart contracts deployed on Base (Chain ID: 8453) are in scope:

Contract	Address	Category
Jackpot	0x3bAe643002069dBCbcd62B1A4eb4C4A397d042a2	Core
JackpotLPManager	0xE63E54DF82d894396B885CE498F828f2454d9dCf	Core
JackpotTicketNFT	0x48FfE35AbB9f4780a4f1775C2Ce1c46185b366e4	Core
JackpotAutoSubscription	0x02A58B725116BA687D9356Eafe0fA771d58a37ac	Helper
BatchPurchaseFacilitator	0x01774B531591b286b9f02C6Bc02ab3fD9526Aa76	Helper
TicketAutoCompoundVault	0x3E22Ea60A1206A4BfEefBCff04D5E9d0A2D9B3Fc	Helper
JackpotRandomTicketBuyer	0xb9560b43b91dE2c1DaF5dfbb76b2CFcDaFc13aBd	Helper
GuaranteedMinimumPayoutCalculator	0x97a22361b6208aC8cd9afaea09D20feC47046CBD	Internal
ScaledEntropyProvider	0x5D030DEC2e0d38935e662C0d2feD44B050c8Ae51	Internal

---

Out of Scope

The following are not eligible for rewards:

• Previously reported issues: Vulnerabilities already submitted or identified in prior audits (Zellic, Code4rena)
• Third-party dependencies: Issues in external contracts (Pyth Network, USDC, etc.) not deployed by Megapot
• Frontend/web application: Vulnerabilities in megapot.io website or API
• Theoretical vulnerabilities: Issues without a working proof of concept
• Best practices: Gas optimizations, code style, or informational findings
• Known limitations: Documented protocol mechanics (e.g., LP withdrawal timing, drawing locks)
• Social engineering: Phishing, social engineering, or physical attacks
• Griefing and denial of service: Attacks requiring excessive capital or transactions with no economic benefit to the attacker, including known griefing vectors documented in prior audits

---

Submission Requirements

Required Information

While the program was active, submissions included:

1. Description: Clear explanation of the vulnerability
2. Impact assessment: What can an attacker achieve? What funds are at risk?
3. Proof of Concept: Working exploit code or detailed reproduction steps
4. Affected contracts: Specific contract addresses and functions
5. Suggested fix (optional): Recommended remediation approach

Submission Process

The program is closed. New reports are not accepted and will not be reviewed. The format below is a historical record of how submissions were structured while the program ran.

Report Format

## Summary
[One paragraph describing the vulnerability]

## Severity
[Critical / High / Medium / Low]

## Affected Contracts
- Contract name: [address]
- Function(s): [function names]

## Impact
[Detailed description of what an attacker can achieve]

## Proof of Concept
[Code, transaction sequence, or detailed steps to reproduce]

## Recommended Fix
[Optional: your suggested remediation]

---

Disclosure Policy

Coordinated Disclosure

We practice coordinated disclosure to protect users:

Phase	Timeline
Acknowledgment	Within 24 hours of submission
Initial assessment	Within 5 business days
Fix development	Up to 90 days, depending on severity
Reward decision	Within 14 days of fix deployment
Public disclosure	After fix is deployed and users are protected

Confidentiality

• Do not disclose the vulnerability publicly until we confirm the fix is deployed
• Do not share details with third parties without our written consent
• Premature disclosure will result in forfeiture of the bounty and potential legal action

Researcher Recognition

With your permission, we will publicly acknowledge your contribution:

• Listed in our security acknowledgments
• Optional: credited in the fix commit or security advisory

---

Safe Harbor

Megapot commits to the following for good-faith security research:

Legal Protection

We will not initiate legal action against researchers who:

• Act in good faith to avoid privacy violations, destruction of data, and service interruption
• Only interact with accounts you own or with explicit permission of the account holder
• Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
• Report vulnerabilities promptly and provide reasonable time for remediation
• Do not engage in extortion or threats

Authorized Testing

Good-faith security research under this policy is considered authorized conduct. We will not pursue civil or criminal action, or support prosecution by others, for accidental, good-faith violations of this policy.

Testing Guidelines

Allowed:

• Testing on local forks or testnets
• Interacting with your own accounts on mainnet
• Reading public contract state

Not Allowed:

• Testing on mainnet with other users’ funds
• Any action that could harm real users or their funds
• Interfering with live drawings or settlements
• Denial of service attacks against production infrastructure

---

Eligibility

To be eligible for a reward, you must:

• Not be a current or former employee, contractor, or auditor of Megapot or Coordination, Inc.
• Not have previously reported the same vulnerability
• Comply with all testing and disclosure guidelines
• Complete KYC verification before payout (required for rewards over $1,000)
• Provide a valid wallet address for USDC payment on Base

---

Reward Determination

Factors Affecting Rewards

Rewards are determined by the Megapot security team based on:

Factor	Impact on Reward
Severity	Primary factor; see severity tiers above
Funds at risk	10% of realistically exploitable funds, capped by tier
Quality of report	Clear PoC and detailed writeup may increase reward
Novelty	First reporter receives full reward; duplicates receive partial or no reward
Fix complexity	Complex fixes requiring protocol changes may warrant higher rewards

Reward Process

1. Validation: We verify the vulnerability is real and in scope
2. Severity assessment: We classify the severity based on impact
3. Fix development: We develop and test a fix
4. Reward calculation: We determine the reward based on the factors above
5. Payout: Reward paid in USDC on Base within 14 days of fix deployment

Disputes

The program is closed. Appeals and new reviews are not being accepted.

---

Contact

The security reporting inbox is closed. New submissions will not be addressed.

For general support or non-security issues, see Help & Support.