> ## Documentation Index > Fetch the complete documentation index at: https://docs.megapot.io/llms.txt > Use this file to discover all available pages before exploring further. # Smart Contract Bug Bounty Program > [!WARNING] > > **This bug bounty program is no longer running.** Submissions will not be addressed. The tables below are a historical record of rewards and scope while the program was active. [Read Announcement](https://megapot.io/blog/thank-you-for-playing). Megapot previously ran a self-administered smart contract bug bounty. That program is closed. Do not send new reports. *** ## Program Overview | Detail | Value | | - | - | | **Maximum Reward** | \$50,000 USDC | | **Reward Calculation** | 10% of funds at risk, capped per severity tier | | **Platform** | Self-administered (historical; program closed) | | **Scope** | Smart contracts deployed on Base | *** ## Rewards by Severity Rewards are based on the [Immunefi Vulnerability Severity Classification System v2.3](https://immunefi.com/severity-system/), which prioritizes the impact of successful exploits. | Severity | Impact | Reward Range | | - | - | - | | **Critical** | Direct theft of funds, permanent freezing of funds, protocol insolvency | $25,000 – $50,000 | | **High** | Theft of unclaimed yield, temporary freezing of funds | $2,500 – $25,000 | | **Medium** | Unbounded gas consumption, contract unable to operate due to logic errors | $100 – $2,500 | ### Critical Severity Examples * Direct theft of LP deposits or player funds * Manipulation of drawing outcomes or winning numbers * Unauthorized minting or transfer of ticket NFTs * Exploiting the entropy provider to predict or influence randomness ### High Severity Examples * Theft of unclaimed referral fees or winnings * Temporary freezing of LP withdrawals beyond the normal settlement period * Manipulation of share calculations to extract excess value ### Medium Severity Examples * Unbounded loops or storage operations that cause non-purchase transactions to exceed block gas limits * Logic errors that prevent contract functionality without fund loss * Theoretical governance parameterizations that could lead to protocol degradation ### Low Severity Examples * Minor calculation errors that don't result in fund loss * UI/contract state inconsistencies *** ## In-Scope Assets All smart contracts deployed on **Base** (Chain ID: 8453) are in scope: | Contract | Address | Category | | - | - | - | | Jackpot | [`0x3bAe643002069dBCbcd62B1A4eb4C4A397d042a2`](https://basescan.org/address/0x3bAe643002069dBCbcd62B1A4eb4C4A397d042a2) | Core | | JackpotLPManager | [`0xE63E54DF82d894396B885CE498F828f2454d9dCf`](https://basescan.org/address/0xE63E54DF82d894396B885CE498F828f2454d9dCf) | Core | | JackpotTicketNFT | [`0x48FfE35AbB9f4780a4f1775C2Ce1c46185b366e4`](https://basescan.org/address/0x48FfE35AbB9f4780a4f1775C2Ce1c46185b366e4) | Core | | JackpotAutoSubscription | [`0x02A58B725116BA687D9356Eafe0fA771d58a37ac`](https://basescan.org/address/0x02A58B725116BA687D9356Eafe0fA771d58a37ac) | Helper | | BatchPurchaseFacilitator | [`0x01774B531591b286b9f02C6Bc02ab3fD9526Aa76`](https://basescan.org/address/0x01774B531591b286b9f02C6Bc02ab3fD9526Aa76) | Helper | | TicketAutoCompoundVault | [`0x3E22Ea60A1206A4BfEefBCff04D5E9d0A2D9B3Fc`](https://basescan.org/address/0x3E22Ea60A1206A4BfEefBCff04D5E9d0A2D9B3Fc) | Helper | | JackpotRandomTicketBuyer | [`0xb9560b43b91dE2c1DaF5dfbb76b2CFcDaFc13aBd`](https://basescan.org/address/0xb9560b43b91dE2c1DaF5dfbb76b2CFcDaFc13aBd) | Helper | | GuaranteedMinimumPayoutCalculator | [`0x97a22361b6208aC8cd9afaea09D20feC47046CBD`](https://basescan.org/address/0x97a22361b6208aC8cd9afaea09D20feC47046CBD) | Internal | | ScaledEntropyProvider | [`0x5D030DEC2e0d38935e662C0d2feD44B050c8Ae51`](https://basescan.org/address/0x5D030DEC2e0d38935e662C0d2feD44B050c8Ae51) | Internal | *** ## Out of Scope The following are **not eligible** for rewards: * **Previously reported issues**: Vulnerabilities already submitted or identified in prior audits ([Zellic](https://github.com/coordinationlabs/megapot-v2-audit-reports/tree/main/zellic), [Code4rena](https://github.com/coordinationlabs/megapot-v2-audit-reports/blob/main/code4rena/)) * **Third-party dependencies**: Issues in external contracts (Pyth Network, USDC, etc.) not deployed by Megapot * **Frontend/web application**: Vulnerabilities in megapot.io website or API * **Theoretical vulnerabilities**: Issues without a working proof of concept * **Best practices**: Gas optimizations, code style, or informational findings * **Known limitations**: Documented protocol mechanics (e.g., LP withdrawal timing, drawing locks) * **Social engineering**: Phishing, social engineering, or physical attacks * **Griefing and denial of service**: Attacks requiring excessive capital or transactions with no economic benefit to the attacker, including known griefing vectors documented in prior audits *** ## Submission Requirements ### Required Information While the program was active, submissions included: 1. **Description**: Clear explanation of the vulnerability 2. **Impact assessment**: What can an attacker achieve? What funds are at risk? 3. **Proof of Concept**: Working exploit code or detailed reproduction steps 4. **Affected contracts**: Specific contract addresses and functions 5. **Suggested fix** (optional): Recommended remediation approach ### Submission Process The program is closed. New reports are not accepted and will not be reviewed. The format below is a historical record of how submissions were structured while the program ran. ### Report Format ``` ## Summary [One paragraph describing the vulnerability] ## Severity [Critical / High / Medium / Low] ## Affected Contracts - Contract name: [address] - Function(s): [function names] ## Impact [Detailed description of what an attacker can achieve] ## Proof of Concept [Code, transaction sequence, or detailed steps to reproduce] ## Recommended Fix [Optional: your suggested remediation] ``` *** ## Disclosure Policy ### Coordinated Disclosure We practice coordinated disclosure to protect users: | Phase | Timeline | | - | - | | **Acknowledgment** | Within 24 hours of submission | | **Initial assessment** | Within 5 business days | | **Fix development** | Up to 90 days, depending on severity | | **Reward decision** | Within 14 days of fix deployment | | **Public disclosure** | After fix is deployed and users are protected | ### Confidentiality * **Do not** disclose the vulnerability publicly until we confirm the fix is deployed * **Do not** share details with third parties without our written consent * Premature disclosure will result in forfeiture of the bounty and potential legal action ### Researcher Recognition With your permission, we will publicly acknowledge your contribution: * Listed in our security acknowledgments * Optional: credited in the fix commit or security advisory *** ## Safe Harbor Megapot commits to the following for good-faith security research: ### Legal Protection We will not initiate legal action against researchers who: * Act in good faith to avoid privacy violations, destruction of data, and service interruption * Only interact with accounts you own or with explicit permission of the account holder * Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue * Report vulnerabilities promptly and provide reasonable time for remediation * Do not engage in extortion or threats ### Authorized Testing Good-faith security research under this policy is considered **authorized conduct**. We will not pursue civil or criminal action, or support prosecution by others, for accidental, good-faith violations of this policy. ### Testing Guidelines **Allowed:** * Testing on local forks or testnets * Interacting with your own accounts on mainnet * Reading public contract state **Not Allowed:** * Testing on mainnet with other users' funds * Any action that could harm real users or their funds * Interfering with live drawings or settlements * Denial of service attacks against production infrastructure *** ## Eligibility To be eligible for a reward, you must: * Not be a current or former employee, contractor, or auditor of Megapot or Coordination, Inc. * Not have previously reported the same vulnerability * Comply with all testing and disclosure guidelines * Complete KYC verification before payout (required for rewards over \$1,000) * Provide a valid wallet address for USDC payment on Base *** ## Reward Determination ### Factors Affecting Rewards Rewards are determined by the Megapot security team based on: | Factor | Impact on Reward | | - | - | | **Severity** | Primary factor; see severity tiers above | | **Funds at risk** | 10% of realistically exploitable funds, capped by tier | | **Quality of report** | Clear PoC and detailed writeup may increase reward | | **Novelty** | First reporter receives full reward; duplicates receive partial or no reward | | **Fix complexity** | Complex fixes requiring protocol changes may warrant higher rewards | ### Reward Process 1. **Validation**: We verify the vulnerability is real and in scope 2. **Severity assessment**: We classify the severity based on impact 3. **Fix development**: We develop and test a fix 4. **Reward calculation**: We determine the reward based on the factors above 5. **Payout**: Reward paid in USDC on Base within 14 days of fix deployment ### Disputes The program is closed. Appeals and new reviews are not being accepted. *** ## Contact The security reporting inbox is closed. New submissions will not be addressed. For general support or non-security issues, see [Help & Support](https://docs.megapot.io/appendix/help-and-support.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.