# Bug Bounty UXD Protocol is proud to offer a generous bug bounty program in order to align the incentives of users and various security testers. UXD Protocol believes a generous bug bounty program is key to protocol security, as it makes the decisions of white and grey hat hackers more aligned with the users of UXD. ### Program Details The program will initiate at UXD Protocol's launch, on January 18th at 14:00 UTC. Although UXD's smart contracts are not yet open sourced, we will still be awarding any critical issues that may be found. **2% of UXP is allocated to our bug bounty program**, coming from the "Community Fund" token allocation. Eventually, these funds may be redirected towards protocol development if voted on by the forthcoming DAO. We use the below severity guidelines (informed by [Immunefi's classification system](https://immunefi.com/severity-updated/)): ![](https://3272050346-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mj8VWsobdvjhMutae2g%2Fuploads%2Fbb60CCo4o8NOATQimgjq%2FScreen%20Shot%202022-01-16%20at%204.16.31%20PM.png?alt=media\&token=a96157c6-5dcc-492c-b523-eb2675a6c2ff) Please direct all bug bounty inquiries to . Please provide a detailed description of the attack vector. If it is possible, we require a demonstrated proof-of-concept on a privately deployed mainnet contract. ### **Other notable exceptions** The following are out of scope for the bug bounty program: * Attacks that the reporter has already exploited themselves, leading to damage and/or loss of funds. * Attacks that the reporter has deployed on a public mainnet which is consequently used by an attacker to exploit, even if the reporter was not the attacker * Attacks requiring access to leaked keys/credentials * Attacks requiring access to other privileged addresses (governance, admin) * Incorrect data supplied by third party oracles (This does not exclude oracle manipulation/flash loan attacks) * Issues arising solely from liquidity * Third party, off-chain bot errors (for instance bugs with an arbitrage bot running on the smart contracts) * Best practice critiques * Sybil attacks