Severity and rewards

Proofline separates two questions:

1. Technical verification. Does the bug exist, can the attack happen, and what concrete impact results?
2. Classification. Given that impact, what does the locked table say?

Once the impact is confirmed, severity isn't a negotiation. If the locked program says Direct theft of user funds = Critical and that impact is demonstrated, the finding is Critical.

#When severity can change

Severity can change when the evidence changes. The reason must name the impact condition that was or wasn't met: "The demonstrated impact meets IMP-M2 rather than IMP-C1 because…". "The team considers this lower" isn't a valid reason.

If a finding is accepted below the severity you requested, you get a 48-hour severity rebuttal window (see Disputes).

#How rewards are calculated

Rewards come from the locked reward table. Every variable is shown in your Casefile.

Fixed rewards:

severity = HIGH
locked reward (fixed) = $50,000
final_reward = $50,000

Percent of funds at risk, bounded by a minimum and a maximum:

severity = CRITICAL
funds_at_risk = $400,000
program_formula = 10% of funds at risk
calculated_reward = $40,000
critical_minimum = $100,000 → raised to minimum
final_reward = $100,000

The payable amount is exactly final_reward. No field exists for a project to substitute a different number. If severity changes, the old calculation is marked superseded and a new one is recorded; both stay on the Proofline.

#The platform fee is never yours

Projects pay Proofline's fee on top of your reward. You always receive the full calculated amount. See Pricing and billing.