RAIN-USDR Smart Contract Audit Contest (Sept 2026): Program info

IN SCOPE VULNERABILITIES

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

• Any governance voting result manipulation
• Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
• Permanent freezing of funds
• Insolvency
• Theft of unclaimed yield
• Permanent freezing of unclaimed yield
• Temporary freezing of funds
• Smart contract unable to operate due to lack of funds
• Block stuffing for profit
• Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
• Theft of gas
• Unbounded gas consumption
• Smart contract fails to deliver promised returns, but doesn’t lose value
• Functional correctness of implementation even if it's not directly impacting user funds
• Best practices, architectural flaws and other types of issues are included at discretion of the team.

OUT OF SCOPE

• Incorrect data supplied by third party oracles
• Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Sybil attacks
• Centralization risks
• Frontend bugs unless leading to smart contract compromise
• Non-exploitable gas optimizations
• Bugs dependent on non-standard compiler settings

The following activities are prohibited by this contest event:

• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against employees and/or customers
• Any denial of service attacks
• Public disclosure of an unpatched vulnerability in an embargoed bounty
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Localize all tests to your accounts
• Perform testing only within the scope
• If multiple chain-level issues are discovered, only the most severe will be rewarded
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of Rain Company without appropriate permission
• Discussion

We use Discord as official communication channel: TBD Join the channel, and create #support ticket to be added for conversation.

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• The vulnerability must be a qualifying vulnerability
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of us or one of its contractor.
• Provide detailed but to-the point reproduction steps
• Automated submissions or AI-generated reports must include human validation.
• Duplicate reports will be rewarded.

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• Rewards may be reduced or disqualified if details are publicly shared prior to fix.
• No vulnerability disclosure, including partial is allowed for the moment.
• Please do NOT publish/discuss bugs

We may offer coordinated disclosure opportunities after vulnerabilities are remediated and upon mutual agreement.

This is non-conditional audit, but in case of all severities unlock bounty disctibution will be next:

• 40% for critical issues
• 30% for high issues
• 15% for medium issues
• 5% gas optimization issues, best practices. Read more

Rewards will be distributed per issue, unless multiple critical vulnerabilities are part of a single exploit chain.

Submission fees are non-refundable.