> For the complete documentation index, see [llms.txt](https://docs.bypassec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bypassec.com/the-platform/rewards-model.md).

# Rewards Model

## Overview

At Bypassec, we reward security researchers fairly and proportionally, reflecting the severity of the vulnerabilities found. Our model is designed to ensure that all efforts are properly recognized and incentivized.

### Vulnerability Validation

At the end of the tournament, all vulnerabilities will be manually validated by the Bypassec team before their statuses are updated.

Incomplete reports or those that do not contain a clear description, reproduction steps, or the required practical evidence (screenshot or video) will be automatically invalidated and will not be eligible for a reward.

{% hint style="warning" %}
During the validation process, Bypassec may contact the researcher via email or Discord if the report requires additional information. The researcher will have **48 hours** to respond before the vulnerability is invalidated.
{% endhint %}

## Severity Classification

The severity levels used to classify vulnerabilities are as follows:

* <mark style="color:green;">**Informative**</mark>
* <mark style="color:blue;">**Low**</mark>
* <mark style="color:$warning;">**Medium**</mark>
* <mark style="color:$danger;">**High**</mark>
* <mark style="color:violet;">**Critical**</mark>

Bypassec uses the [CVSS Score 3.1](https://www.first.org/cvss/calculator/3.1) as a reference to classify the severity of vulnerabilities.

However, it is important to emphasize that severity may vary based on the impact of the vulnerability, its relevance to the organization, and the ease of exploitation.

{% hint style="info" %}
In the event of conflicts between the classification model and the specific competition policy, the competition policy will prevail.
{% endhint %}

## Reward Pool Distribution

Each competition on Bypassec has a reward fund that will be distributed based on the severity of the reported vulnerabilities. Below are the details of the distribution:

### <mark style="color:blue;">**Low**</mark> Severity

If only low-severity vulnerabilities are reported:

| Severity | Pool Percent |
| -------- | ------------ |
| Low      | 20%          |

### <mark style="color:$warning;">**Medium**</mark> Severity

If medium-severity vulnerabilities are reported:

| Severity  | Pool Percent |
| --------- | ------------ |
| Low       | 15%          |
| Medium    | 35%          |
| **Total** | **50%**      |

### <mark style="color:$danger;">**High**</mark> and <mark style="color:violet;">**Critical**</mark> Severity

If high- or critical-severity vulnerabilities are reported:

#### Without Critical Reports

| Severity  | Pool Percent |
| --------- | ------------ |
| Low       | 10%          |
| Medium    | 30%          |
| High      | 60%          |
| **Total** | **100%**     |

#### With Critical Reports

| Severity  | Pool Percent |
| --------- | ------------ |
| Low       | 5%           |
| Medium    | 20%          |
| High      | 30%          |
| Critical  | 45%          |
| **Total** | **100%**     |

### Special Cases

{% hint style="info" %}
If a specific severity level in the table is not reported, its percentage of the fund will be distributed equally among all higher severity levels.
{% endhint %}

## Duplicate Vulnerabilities

At Bypassec, duplicate vulnerabilities are also rewarded. If a vulnerability is duplicated, the reward for that specific flaw will be divided among all researchers who reported it.

For example, let’s imagine that four reports were submitted: <mark style="color:purple;">**A**</mark>, <mark style="color:purple;">**B, C**</mark> and <mark style="color:purple;">**D:**</mark>

* Report **A** is a unique vulnerability
* Reports **B**, **C**, and **D** are the same vulnerability

In this case, the three identical reports will split the prize allocated for that vulnerability. The distribution would be as follows:

| Report ID | Reward                                         |
| --------- | ---------------------------------------------- |
| A         | $ <mark style="color:orange;">**X**</mark>     |
| B         | $ <mark style="color:orange;">**X / 3**</mark> |
| C         | $ <mark style="color:orange;">**X / 3**</mark> |
| D         | $ <mark style="color:orange;">**X / 3**</mark> |

This reward model ensures that all researchers who contribute to the security of the application are recognized, even when reporting duplicate vulnerabilities.

## Points

For every valid vulnerability reported, the researcher will receive points. This score will be used to determine the researcher's position in the Bypassec global ranking and define their performance.

### Points Distribution

Points are distributed based on the severity and uniqueness of the vulnerability found.

| Severity                                        | Unique | Duplicate |
| ----------------------------------------------- | ------ | --------- |
| <mark style="color:blue;">**Low**</mark>        | 10     | 5         |
| <mark style="color:yellow;">**Medium**</mark>   | 20     | 10        |
| <mark style="color:red;">**High**</mark>        | 30     | 15        |
| <mark style="color:purple;">**Critical**</mark> | 40     | 20        |

### Why earn points?

Scores are the metrics used by Bypassec to identify the top researchers on the platform. These researchers will have the opportunity to receive exclusive advantages and rewards, such as:

* Invites to private competitions
* Job interview opportunities
* Bypassec merchandise and swag
* Reward bonuses
* Discounts on mentorships and courses from Bypassec partners

{% hint style="info" %}
These advantages will be defined and distributed spontaneously at specific periods determined by Bypassec, serving as an incentive for researchers.

None of the items described above constitutes a guarantee or should be viewed as a mandatory obligation to be provided by Bypassec.
{% endhint %}