# Welcome to Gitcoin support We've curated a collection of the most commonly asked support questions. Don't see your question below? You can use the search bar in the search through our knowledge base articles. ### Most commonly asked questions {% content-ref url="/pages/79NDAv2KWxfXuq2zP5ZI" %} [cGrants/Bounties & Hackathons Sunsetting FAQ](/gitcoin-knowledge-base/misc/cgrants-bounties-and-hackathons-sunsetting-faq) {% endcontent-ref %} {% embed url="" %} {% content-ref url="/pages/KdjWpxLNQoHCjRSWkY5t" %} [Broken mention](broken://pages/KdjWpxLNQoHCjRSWkY5t) {% endcontent-ref %} {% content-ref url="/pages/btwP5mV3iQg1kMnm0eKT" %} [Broken mention](broken://pages/btwP5mV3iQg1kMnm0eKT) {% endcontent-ref %} ### Looking for Passport's knowledge base? We've moved Passport's support content to a new site. Learn more by visiting [Passport](/gitcoin-knowledge-base/misc/passport) ### Did we answer your question? If you still need to contact Gitcoin Support directly: * [Email us at support@gitcoin.co](mailto:support@gitcoin.co) # What is Gitcoin Grants Stack? [Gitcoin Grants Stack](https://www.gitcoin.co/grants-stack) is the first-ever decentralized, customizable, smart contract-enabled solution that connects grants program managers, project owners and community members to manage and participate in community-oriented grants programs. The product suite enables a streamlined management process for grant program managers–from program setup to application management to funds allocation–making it easy to manage and grow their program. It encourages community members to discover and support new projects in their digital neighborhood. It empowers project owners to seek funding, apply to grants programs, and build their web3 reputation and beyond. Gitcoin Grants Stack has *three main components* that make it possible to manage, discover, donate to, and participate in grants programs. ### **Manager** Enables program managers to create and deploy a program plus track and manage grantee applications and simplify approvals processes. * Ability to receive and approve applications created in Builder * Ability to run Quadratic Funding rounds with Passport Sybil Defense * Ability to do bulk payouts ### **Explorer** Encourages donor discovery and support of different programs and projects. * Ability to browse and discover different grantees within a given Quadratic Funding grants round * Ability to donate to different applicants/projects ### **Builder** Empowers project owners to create a single profile where they can build reputation and manage applications, and accept direct donations. #### **Project Management:** * Create a project on any supported chain * Edit an existing project (note: edits to a project would only be reflected in applications submitted after the change) #### **Application Management:** * Apply to a grants round on any supported chain * View application status (Approved/Rejected/In Review, or Active) #### **Project Reputation Creation & Verification:** * Verify ownership of their project credentials (currently just for Twitter & Github) * View project stats - See and manage grant rounds they’ve applied to and/or participated Additionally, through an integration with [Gitcoin Passport](https://passport.gitcoin.co/), it also helps with identifying & protecting from bad actors (Sybils) on the donor and applicant sides, preventing the draining of program funds. *For a deeper dive, visit* [*Gitcoin Grants Stack: Your Tools to Fund What Matters.*](https://www.gitcoin.co/grants-stack) # What is the Gitcoin Grants program? The Gitcoin Grants Program is a quarterly initiative run by Gitcoin that empowers everyday believers in web3 to drive funding toward what they believe matters, with the impact of individual donations being magnified by the use of the [Quadratic Funding (QF)](https://wtfisqf.com/) distribution mechanism. QF was introduced in a [paper](https://arxiv.org/abs/1809.06421v1) published in 2018 by Vitalik Buterin, Zoe Hitzig, and Glen Weyl. Gitcoin’s mission began in 2017 by creating better incentives to support and fund open-source software developers. The mission eventually solidified to building and sustaining digital public goods. GR1, in 2019, saw 200 contributors and **$38k** raised. Since then, we have run two-week rounds once per quarter, with the most recent being GR15, which saw a total of **$4.4M** distributed to grantees. Across the first 15 grant rounds, $**50.82M** has been distributed in total. During a QF round, the community contributes to the project they feel should be funded and supported; a matching partner offers funds to match the community’s contributions, but not in a 1:1 match. Instead, the fund matching is more aligned with the sentiment of the community as opposed to the sheer dollar value amount raised by any grantee. The *number of contributions* matters more than the *amount funded.* *‍*If you want to keep up to date on our current and upcoming rounds, make sure to check the [Grantee Portal](https://gitcoin.notion.site/Gitcoin-Grantee-Portal-6adfc92627474bd48a5dfcd1e8438d20) often or sign up for email updates by going to [Gitcoin.co](https://www.gitcoin.co/), scrolling to the bottom of the page and filling out the form, checking the box “Funding my Project” and submitting your info. {% embed url="" %} Have more questions? They might already be answered in our grants FAQs. If not, you can [email our support team](mailto:support@gitcoin.co). ### Related topics {% content-ref url="/pages/rNaD0vsm0zurDFbu4Im0" %} [Broken mention](broken://pages/rNaD0vsm0zurDFbu4Im0) {% endcontent-ref %} {% content-ref url="/pages/wdXeHCJfyTGqODDZvPQC" %} [Broken mention](broken://pages/wdXeHCJfyTGqODDZvPQC) {% endcontent-ref %} {% content-ref url="/pages/brHzfSHpA6QK50nftG5t" %} [Gitcoin Grants FAQ](/gitcoin-knowledge-base/gitcoin-grants/general-questions) {% endcontent-ref %} # How is the Gitcoin Grants program changing? Gitcoin is transitioning from cGrants to the Grants Protocol Historically, the Gitcoin Grants Rounds operated on a quarterly cadence. However, [Governance](https://gov.gitcoin.co/) has approved the decision to retire our centralized quadratic funding platform (cGrants) and transition to a decentralized and customizable [Gitcoin Grants Stack](/gitcoin-knowledge-base/gitcoin-grants-program/what-is-gitcoin-grants-stack), which is in sync with our destination as GitcoinDAO. As a result, Gitcoin ran a streamlined Alpha Round on the protocol in January 2023 with the goal of testing the product while supporting established grantees. The next phase of this testing period introduces the [Gitcoin Grants Beta Round](https://go.gitcoin.co/blog/announcing-the-gitcoin-grants-beta-round) in April 2023. Gitcoin’s renewed purpose which was ratified in July of 2022 is ***To Empower Communities to Fund their Shared Needs.*** In order to fulfill this purpose fully, we are creating a suite of permissionless, modular, and decentralized protocols that will allow communities to rapidly test different funding mechanisms on top of a deeply liquid registry of projects and enable projects to grow sustainably. ### Why are these changes being made? Even though Gitcoin Grants built a strong use case for the value of Quadratic Funding to fund public goods, we built it as a centralized platform. It has come to a stage now where we need to decentralize it to scale it more widely and achieve our purpose. Read this in-depth blog to learn more: [Announcing the Decentralized Future of Gitcoin Grants](https://go.gitcoin.co/blog/announcing-the-decentralized-future-of-gitcoin-grants) # Tips for Grant Success Advice for first-time and returning Grantees. ## SUBMITTING A NEW GRANT APPLICATION #### Upload your grant early Try to get it ready 15 days before the start of the Grants Round. Give time to the process of getting your grant approved and for the team to review your Tags Request. #### Start with a TL;DR or summary Provide a brief overview of what it is that you're trying to do. Some key questions to answer upfront: * How do you intend to spend the money? * Why is this the right thing to focus on? * Any other specific relevant information. * If you are tagging your project for a specific round, be very proactive about trying to illustrate how your project fits within that round. Many donors only read the beginning of a grant proposal, so start with a concise summary that includes how you plan to use the grant funding. You can add more technical specifications further down, or link to your website for more details #### Explain what you are building & why it's essential in your grant title Placing header descriptions is very helpful when going through grants - it gives you an idea of what they are about. Keep your description simple and clear. The first line of your description will also be visible in your thumbnail so it is a good idea to communicate your best hook right here. #### Compare your solution vs the Status Quo When describing your project, try to demonstrate its importance by contrasting your solution to a well-known project. This is a powerful statement that clearly demonstrates what exactly you are trying to change and why. #### New to Gitcoin and have more questions about setting up your grant? Check out the following [Grantee Onboarding Guide](https://www.notion.so/gitcoin/Gitcoin-Grantee-Onboarding-Document-bbfe106a32534fb5a011f09c121257c3). #### Grab people’s attention Choose your banner, headline picture, and title carefully. You do not have to use your logo. Any visually compelling picture can be uploaded here. These images are important signals that will help your proposal gain attention. There are many projects on the Gitcoin platform so choose a picture and title that will make your project stand out. #### Share information about your Team Members Often, the people involved in the project are just as critical as the innovation itself. Make sure you include a list of your key project members and their qualifications. ## SHARING RESULTS FROM PREVIOUS ROUNDS #### Explain the results from your latest round and your plans for the current one These are two very important sections to be included in your Grant page. Be very specific about all the activities and projects you worked on with the funds from the latest round. Share finished projects or products so that the community can see their support materialized. And of course, set up a detailed plan of your plans moving forward if the community decides to support you again. #### Have a separate section to prove your impact A very important success factor is that your supporters want to know what you end up doing with their funds and how that success is shared transparently with the community. Document your previous impact. ## COMMUNITY BUILDING AND MARKETING YOUR GRANT #### Share your failures as part of your evolution We all know you are not perfect. There is a lot of value in showing the community that you are learning from your mistakes and listening to the feedback after trying something. It didn't work but you have a plan moving forward. People will want to support a team that seems to be iterating. One of the most beautiful ideals of open source development is doing and learning in public. So there's a lot of openness and receptivity to witnessing your project as emergent and in the process of becoming. It doesn't have to all be figured out ahead of time as long as you're clear about where things are and communicate that in your project proposal. #### Twitter engagement is more important than a large following Often the most successful grantees have a true and solid community. Never get disconnected from your audience (do not contact them only when you are crowdfunding). Once they start following your project, maintain constant contact with all of them. Don’t worry about your following numbers, just focus on having a true connection with your actual community and make sure they are fully engaged with your project. #### Reach out to your community early Probably many of your current followers are not yet onboarded to web3. So you have to consider all the time they will need to set up a wallet, create a Gitcoin account, a Gitcoin passport, and even troubleshoot many aspects during checkout. So reach out early in the round so you can help them with all of this without having the pressure or risk of losing the round matching window. Attend and cheer up for other grantees’ community events Stay connected in all the different spaces. It is not a zero-sum game: The more we all rise, the bigger the tide. # Gitcoin's KYC ### What is KYC? * KYC stands for ‘**K**now **Y**our **C**ustomer,’ and it is a set of regulated standards used to verify identity in order to prevent criminal activity and fraud. It is something Gitcoin must comply with in order to prevent legal actions and fines. * Another benefit of KYC is that it helps us address questions from our matching partners. Before donating matching funds, our partners want to ensure that their funds are going to legitimate grantees. ### Who needs to do KYC? * Grantees earning more than $15k in matching funds OR in the a16z round. There is a separate KYC process for each of these. ### How do you fulfill the KYC requirements if you have more than $15k in matching funds? * Grantees earning more than $15k in matching funds should look for an email from and follow the requirements. You will need to provide the following information: #### For persons: * Full Name * Physical Address * (Only if you’re a US Citizen) Social Security Number * Proof of physical address (such as a utility bill, water bill, landline bill, electricity bill, internet bill, gas bill, or bank statement) * Proof of identity (government issued ID) #### For corporations: * Corporation Legal Name * Physical Address * Proof of physical address (utility bill, or bank statement) * Proof of Incorporation ### Why is there a separate process for the a16z round? Certain rounds may have their own specific KYC requirements and process - so far this has only been the a16z round. Grantees in that round will have received an email with more info on the specific requirements. ### If I’ve done KYC with Gitcoin in the past, do I need to do it again? Yes, we have created a new system for GR15 therefore you will need to complete KYC again for this for the new system. ### How long will it take for me to hear back? It typically takes 2-5 business days to verify you met the requirements for Gitcoin’s KYC process. Once you’ve met the KYC requirements, you will receive a notification to claim your matching funds ### Will my information be kept private? * Yes, when fulfilling Gitcoin’s KYC requirements, your information will be entered into a software tool we use to verify identity and only be made available to a select number of people at Gitcoin. No one else. * We do however share with funding partners the status/outcome (not the details) of that KYC process. This helps partners confirm someone they are funding is not on a sanctions list. ### Why does Gitcoin have a KYC requirement? Gitcoin must abide by the legal restrictions of the jurisdictions we are registered in. Certain round sponsors may also have their own requirements based on their jurisdiction. We believe in privacy but must follow applicable laws. # Gitcoin Grants FAQ Get answers to questions commonly asked about Gitcoin Grants. We've curated a collection of the most commonly asked general questions about Gitcoin Grants. Don't see an answer to the question you have? Let us know by reaching out on [the Gitcoin Discord](https://discord.com/invite/b5PEjyVFXT), and we'll consider adding it. ### General {% content-ref url="/pages/lbFDCJINMcl1E3TcRYpz" %} [When is the next Grants Round?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/when-is-the-next-grants-round) {% endcontent-ref %} {% content-ref url="/pages/p8njIyqpZ9Ufgb7TuNp1" %} [What are Public Goods?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/what-are-public-goods) {% endcontent-ref %} {% content-ref url="/pages/qHRTEyf0LJ0K7eo8WT36" %} [Why should I contribute?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/why-should-i-contribute) {% endcontent-ref %} {% content-ref url="/pages/ylx1Dpqf7XA7AHbP3wTz" %} [What are the Grants Round rules I need to follow?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/are-there-any-grant-rules-i-need-to-follow) {% endcontent-ref %} {% content-ref url="/pages/FV419m979hCfOOBmyZOd" %} [Broken mention](broken://pages/FV419m979hCfOOBmyZOd) {% endcontent-ref %} ### Technical questions {% content-ref url="/pages/xAN2Y0MQu4xfbIEP82Mi" %} [What is Quadratic funding?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/whats-quadratic-funding) {% endcontent-ref %} {% content-ref url="/pages/V3sDAlpcx8VT6QsSE5qx" %} [Why is Quadratic funding powerful?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/why-is-quadratic-funding-powerful) {% endcontent-ref %} {% content-ref url="/pages/aXB11jPIQ41xvm08aDFU" %} [How do you prevent Sybil attacks?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/how-do-you-prevent-sybil-attacks) {% endcontent-ref %} {% content-ref url="/pages/MiwfAbcveioCfjjuFjS3" %} [Broken mention](broken://pages/MiwfAbcveioCfjjuFjS3) {% endcontent-ref %} ### Reporting problems {% content-ref url="/pages/Hdu9z1XTMPEttijCDmVo" %} [I see a bug or I've got a question, what do I do?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/i-see-a-bug-or-ive-got-a-question-what-do-i-do) {% endcontent-ref %} ### Results {% content-ref url="/pages/dHOqh7YTBkUW2CMRQkvR" %} [How much volume has Gitcoin Grants done?](/gitcoin-knowledge-base/gitcoin-grants/general-questions/how-much-volume-has-gitcoin-grants-done) {% endcontent-ref %} ### Did we answer your question? Don't see an answer to your question? [Join the Gitcoin Discord](https://discord.gg/b5PEjyVFXT) or [submit a ticket to support](https://support.gitcoin.co/new/). # When is the next Grants Round? Major changes to the Gitcoin quarterly Grants Rounds program Historically, the Gitcoin Grants Rounds operate on a quarterly cadence. [Governance](https://gov.gitcoin.co/) approved the decision to sunset centralized grants (cGrants) and transition to the [Gitcoin Grants Stack](/gitcoin-knowledge-base/gitcoin-grants-program/what-is-gitcoin-grants-stack). We began this transition by introducing the [Alpha Test Season](https://go.gitcoin.co/blog/announcing-the-gitcoin-alpha-tests) late 2022, where we began testing our new protocol with partner rounds and a Gitcoin-managed round. Sticking with our quarterly cadence, we have entered the Beta phase of testing. ## Current Grants Round * [GG19](https://www.gitcoin.co/blog/gg19-results-and-recap) just concluded. ## Upcoming Grants Rounds * *The next Gitcoin Grants round will run from April 23 - May 7th.* ## Previous Grants Rounds * GG19: November 15 - 29th * [GG18](https://www.gitcoin.co/blog/announcing-gitcoin-grants-18): August 15 - 29th * [Gitcoin Grants Beta Round](https://go.gitcoin.co/blog/announcing-the-gitcoin-grants-beta-round): April 25th - May 9th 2023 * Gitcoin Program Alpha Round: Jan 17 - 31, 2023 * Fantom Round: Dec 12, 2022 - Jan 2, 2023 * UNICEF Round: December 9-21, 2022 * GR15: September 7-22, 2022 * GR14: June 8-23, 2022 * GR13: March 9-24, 2022 * GR12: December 1-16, 2021 * GR11: September 8-23, 2021 * GR10: June 17-July 1, 2021 * GR9: March 10-25, 2021 * GR8: December 2-17, 2020 * GR7: September 15-October 2, 2020 * GR6: June 15-July 3, 2020 * GR5: March 23-April 4, 2020 * GR4: January 6-January 21, 2020 * GR3: September 15- October 2, 2019 * GR2: March 5-April 19, 2019 * GR1: February 1-February 15 2019 # What are Public Goods? > **“In economics, a "public good" refers to anything that is both *****non-excludable***** and *****non-rivalrous,***** that is, people can't be barred access, and one person's use doesn't degrade another's.** Clean air is an example of a naturally occurring public good, while the electric grid is a public good created by people. #### What are the public goods of today's industrial-knowledge society? Open source code, which supports millions of companies and independent developers, is often thought of this way. The cypherpunks considered privacy itself as a kind of public good. A **great public good** should: **• Be values-based** — in service of a set of values your community cares about. **• Have longevity** — be achievable and maintainable. **• Create positive externalities** — benefits a public beyond an immediate set of users. Gitcoin started off focusing on Digital Public Goods (like Open Source software) but we have now expanded into real-life Public Goods. To learn more about public goods checkout: {% embed url="" %} # Why should I contribute? By making an individual donation, you can have a huge impact on a public good. Contributions of 1 DAI can sometimes mean up to 400 DAI in matching. Your contributions will be met by matching funding, widening the reach of your donation. If 10 persons contribute 1DAI each (= 1 USD) the QF matching will be higher than if only 1 person is contributing 10DAI or 2 persons 5DAI each. TL;DR; - Your contribution is your vote, and it's more valuable than you think. Your money is having a real impact on Gitcoin Grants. # What are the Grants Round rules I need to follow? Any contribution that can be converted to USDT will be matched during an active match round. It will be matched as from a new unique contributor provided: 1. It is from a new identity that has not contributed before. 2. Identity requirements continue to evolve but for Grants Round 13 a unique identity is a Github account that is older than the Grants Round. 3. Identity requirements are subject to the pretence that a contribution is not a Sybil attack or collusion. We define collusion per [the CLR Paper](https://arxiv.org/pdf/1809.06421.pdf) as: > The central vulnerabilities of LR, as with other mechanisms designed based on the assumption of unilateral optimization, are collusion and fraud. Collusion takes place when multiple agents act in their mutual interest to the detriment of other participants. Fraud takes place when a single citizen misrepresents herself as many. To call one case out specifically due to confusion in previous rounds, please avoid any form of quid pro quo that has financial value (*i.e. a scenario in which a user gets some additional unique benefit/award in return for their donation*). We define a [Sybil attack]() as: > In a Sybil attack, the attacker subverts the reputation system of a network service by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence. It is named after the subject of the book Sybil, a case study of a woman diagnosed with a dissociative identity disorder. [Learn more about our anti-collusion growth strategy](https://twitter.com/owocki/status/1273458452900151296) ### Some definite examples of rule-breaking * Offering quid-pro-quo for a contribution. * Creating a new identity to contribute. * Attempting to falsify a contribution. We cannot possibly enumerate every single literal example of a breaking of the above rule, so please treat the above list as an incomplete list. You should refer to the definitions of Sybil and collusion attack in the CLR paper as the canonical source of truth for the rules. Rule violations can lead to a reduction or nullification of your matching bonus. # What is Quadratic funding? The **quadratic funding mechanism (QF)** is a concrete proposal for turning your small donations into something much larger. It requires a simple formula to achieve this goal. Crowdfund individual donations towards open source projects (try to have the maximum of contributors, it's the number of participants that counts, not the amount of contribution). A match from governments, grant programs, or private philanthropists (offered by sponsors/donors for the grant's round fund). Read more about QF here: {% embed url="" %} # Why is Quadratic funding powerful? The QF Mechanism measures the breadth of contributors, not the depth of contributions - which is a very democratic funding model. QF pushes power to the edges of the network! Economist Glen Weyl has called QF the 'optimal way to fund public goods that a broad base of the population cares about. # How do you prevent Sybil attacks? 1\. We use aged Github accounts, SMS verification, BrightID, a few other undisclosed vectors, and Idena Network/ other DID solutions, as an identity solution for Gitcoin Grant contributions. Check out the trust tab of your profile to increase your trust level. 2\. In addition to Github's native anti-Sybil technology, we programmatically check these accounts for signs of Sybil attacks. Each contribution is assigned a trust score according to the likelihood that its part of a Sybil attack. Right now we do not take any action against Sybil attacks (other than the most egregious cases), but we are quietly collecting data to use in the future. 3\. We use Vitalik Buterin's pairwise bonding formula to dampen Sybil attacks {% embed url="" %} More on our anti-Sybil growth strategy here: {% embed url="" %} # I see a bug or I've got a question, what do I do? If you have a question please check the Gitcoin knowledge base first to see if it is already answered. If not, or you'd like to report a bug, you can reach out to us via live chat or email . # How much volume has Gitcoin Grants done? As of May 2022, Gitcoin has helped fund $57.8m to public goods. In Q1 2022, Gitcoin facilitated $8.2m in value transfer. Since Gitcoin launched in November 2017, Gitcoin has helped 75,861 funders reach an audience of 312,820 earners. Gitcoin has facilitated 2,046,852 complete transactions to 10,431 unique earners. View the full breakdown: {% embed url="" %} # What is our Quid Pro Quo Policy? #### Quid Pro Quo is Latin for ‘Something for Something.’ At Gitcoin, it means providing a reward to donors for contributing to a particular project. This can result in the project being removed from the matching distribution and the funding round. ### Why does this policy exist? We are committed to maintaining the integrity of Quadratic Funding mechanisms. Quadratic Funding is designed to amplify the impact of community contributions to projects they value, based on the principle that individuals contribute because they appreciate the project's potential outcomes. However, this goal is threatened by the emergence of external incentives that distort the intended purpose of these contributions. Side-incentives, or motivations external to the project's objectives distort contribution behaviors. This distortion arises when contributors are motivated more by personal gains than by the success of the projects they support, undermining the quadratic funding model. Furthermore, the nuanced nature of motivations and the timing of rewards, such as airdrops after contributions, complicate efforts to police behavior and ensure fairness. Our goal is to foster an environment where contributions are motivated by a genuine interest in the success of community-valued projects. #### **It is not allowed to reward a donor for their contributions to specific project(s). This includes, but is not limited to, the following examples:** * Exclusive Invitations to events, meetings, or spaces for donors to specific projects * Personalized Rewards or Services, such as consulting or coaching, in exchange for donations * Gas Fee Reimbursements for donating to particular projects #### It is however valuable to encourage broad participation without undermining the principle of impartial support. The following are allowed: * General Acknowledgments that thank all donors to a round or cause * Open Invitations to community events that welcome all donors, regardless of the projects they have supported * Community Badges that recognize participation in the funding round as a whole If you hear/see someone violating these rules please flag it[ here](https://forms.gle/7GEDS7tPtk1oiXaN7) for our team to investigate. We take all information seriously. Violation of these rules can result in being removed from the matching distribution. If you have any questions about the policy please reach out to our team # What is Gitcoin? Connect with the community developing protocols that help communities fund their shared needs. ### Our Purpose Our purpose is to empower communities to fund their shared needs. This purpose guides our work as both an impact and protocol DAO. We are focused on building and funding tools that support community-driven shared resources. ### How we support our purpose Gitcoin is a community first, and our software products are a double-sided market that connects digital creatives to the people who want to fund their work. As of April 2023, our grants program has [distributed over $50M of funding](https://impact.gitcoin.co/). ### The DAO that governs Gitcoin In order to make sure that Gitcoin is serving its mission and community first, Gitcoin is governed by the community. In May 2021, [GTC was released](https://gitcoin.co/blog/introducing-gtc-gitcoins-governance-token/). GTC is a governance token with no economic value that governs Gitcoin Grants + GitcoinDAO. There are three important concepts to know to understand how to interact with GitcoinDAO. 1. Most of the action happens on [Discord](https://gitcoin.co/discord), [gov.gitcoin.co](https://gov.gitcoin.co), or [Twitter](https://twitter.com/gitcoin) 2. [Stewards](https://gitcoin.co/blog/introducing-the-community-stewards-program/) are ultimately responsible for governing GitcoinDAO. ### How to get involved. Here are the ways you can get involved in the DAO. 1. Get engaged on [discord](https://gitcoin.co/discord), [gov.gitcoin.co](https://gov.gitcoin.co), or on [Twitter](https://twitter.com/gitcoin) 2. Explore any of the links below: ### Links * [Gitcoin.co](https://gitcoin.co) * [Gitcoin Schwag Store](https://store.gitcoin.co) * [Gitcoin Support](https://gitcoin.co/support) * [Gitcoin twitter](https://twitter.com/gitcoin) * [Gitcoin discord](https://gitcoin.co/discord) * [GitcoinDAO Snapshot](https://snapshot.org/#/gitcoindao.eth/) * [GitcoinDAO Tally](https://www.withtally.com/governance/gitcoin) * [GitcoinDAO/GTC Governance token](https://etherscan.io/token/0xde30da39c46104798bb5aa3fe8b9e0e1f348163f) ## Testimonials > Gitcoin Grants is establishing itself as a significant pillar of the Ethereum ecosystem that more and more projects are relying on for some or all of their support. \~ [Vitalik Buterin](https://vitalik.ca/general/2020/04/30/round5.html) > I LOVE IT…The community has been outstanding. I have made contact outside of slack w a couple of people. William Schwab was kind enough to ZOOM w me for an hour and tell me his story, letme pick his brain, and as he shared some valuable resources with me. - John Wilkinson > Gitcoin gave me the first break into Ethereum and the crypto space. It helped me find bounties that I could work on and get paid in crypto. After my first ever bounty I got paid a lot and I felt euphoric. - Sebastian TF > I am amazed on a daily basis at the incredible projects and communities in this space. The Gitcoin team and quadratic funding is an invaluable catalyst to bring it all to fruition. Thank you! - Hishamaru Konkon > Gitcoin grants quadratic funding is not just for funds allocation, it’s also a great signaling tool! For the last few rounds, going to [Grants | Gitcoin](https://gitcoin.co/grants/) has led me to discover a lot of really cool Ethereum projects I previously did not know about. - Vitalik Buterin > What Gitcoin is doing with public goods funding is absolutely incredible. Nothing but respect to the team and the larger community for the contributions made. - Frobo > Thanks to [@gitcoin](https://gov.gitcoin.co/u/gitcoin) it has helped us to discover our earliest talent and supercharged @KodaDot development. - Matej > People ask me all the time how I got into Solidity and NFT dev. The answer is [@gitcoin](https://gov.gitcoin.co/u/gitcoin)! Beginning of the year I just started doing bounties for a bunch of different projects (@synthetix\_io @akashnet\_ @SovrynBTC etc) and found the NFT ones were my fave. Such a good way to learn! - sarasioux.eth # Code of Conduct ### Our Pledge In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. ### Our Standards Examples of behavior that contributes to creating a positive environment include: * Using welcoming and inclusive language. * Being respectful of differing viewpoints and experiences. * Gracefully accepting constructive criticism. * Focusing on what is best for the community. * Showing empathy towards other community members. * Demonstrating transparency and honesty in all interactions. * Taking responsibility for mistakes, apologizing, and learning from the experience. Examples of unacceptable behavior by participants include: * The use of sexualized language or imagery and unwelcome sexual attention or advances. * Trolling, insulting/derogatory comments, and personal or political attacks. * Public or private harassment (including but not limited to continuous messaging when explicitly asked to stop). * Publishing others' private information, such as a physical or electronic address, without explicit permission. * Other conduct which could reasonably be considered inappropriate in a professional setting. * Insults, racism, harassment, or threats of violence against members, even as a joke. * Posting unsolicited referral links or Discord invitations. * Posting NSFW content and using offensive language. * Sharing API or secret keys. * Asking for money, especially impersonating a moderation team member. * Impersonating members of the moderation team. * Discussing illegal activities, including tax evasion and market manipulation. * Posting off-topic discussions outside of designated threads. ### Our Responsibilities Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct or to ban temporarily or permanently any contributor for behaviors that they deem inappropriate, threatening, offensive, or harmful. ### Scope This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces (Discord, Telegram, Twitter, Farcaster, etc). Examples include using an official project e-mail address or handle, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. ### Enforcement Instances of abusive, harassing, fraudulent, or otherwise unacceptable behavior should be reported by contacting the Gitcoin team at . All complaints will be reviewed and investigated, resulting in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. ### Escalation and Appeal #### Initial Report: Instances of unacceptable behavior should be reported by contacting the Gitcoin team at with the offense, time and location of the offense and any supporting documentation. #### Review and Investigation: All complaints will be reviewed and investigated. The project team will maintain confidentiality with regard to the reporter of an incident. #### Response: Gitcoin will respond with necessary and appropriate actions based on the investigation’s findings and based on the escalation, and the Three Strikes rule outlined below. #### Escalation: If the initial response is deemed insufficient, the issue can be escalated to a higher authority within the project's leadership or bringing forth the inquiry to the forum. The escalation process involves a review by the Grants Council to ensure impartiality. #### Appeal: Individuals subject to enforcement actions may appeal the decision by providing additional context or evidence to Gitcoin. Appeals must be submitted in writing within 30 days of the enforcement action. ### Consequences for Ongoing and Future Participation #### Live Round Violation: If a participant is found to violate the Code of Conduct during a live round on Gitcoin, they may face immediate suspension or removal from the round. This includes forfeiture of any matching funds or rewards. This will be put to a vote within the community once a third strike has occurred. #### Future Participation: Violations of the Code of Conduct may result in a ban from participating in future Gitcoin rounds or activities. The duration and conditions of the ban will be determined based on the severity of the violation. Violators may make an appeal to the Community Council ahead of any upcoming rounds and after 6 months. ### Additional Community Guidelines * Be respectful of each other’s thoughts and opinions. Insults, racism, harassment, or threats of violence against members will not be tolerated. * This is a community space free from advertising. Do not post unsolicited referral links or Discord invitations unless specifically asked for by another user. * Do not post any NSFW content and limit the use of offensive language across all channels and nicknames. * Never share API or secret keys, whether they are free or worthless. Those are for your use only. * No user should ever ask you to send them money, especially not members of the moderation team. Report such incidents to any available @admins immediately. * Impersonating members of the moderation team is an offense. Anyone caught doing this will be instantly banned and reported. * Be conscious that text communications in this server may be monitored by law enforcement. Refrain from discussing anything illegal, including tax evasion and market manipulation. * Keep discussions organized by posting in their respective threads. Moderators may reassign discussions to the appropriate thread to maintain order and relevance. ### Three Strikes Rule To maintain a fair and consistent approach to enforcement, we will adopt a three strikes rule: #### First Strike: Warning A private, written warning, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. #### Second Strike: Formal Notice A formal notice will be issued, and the violator will be required to acknowledge the violation and commit to adhering to the Code of Conduct, this includes temporary suspension from community activities (Twitter Spaces, Discord, Forum Posting, etc) #### Third Strike: Official Forum Post with Vote The violation will be escalated to an official forum post, where the community can vote on the appropriate action, which may include a permanent ban or relegation to a different application process in the future. By adopting these comprehensive guidelines, Gitcoin aims to ensure a respectful, inclusive, and professional environment for all community members. # Other Policies # Gitcoin Grants Platform and Technology In order to truly decentralize governance of Gitcoin Grants to Community Stewards, we must decentralize the Gitcoin platform and technology. Currently Gitcoin Holdings operates the Grants product. Information about the process of decentralization and basic timeline can be found in the Decentralize Gitcoin Workstream on: {% embed url="" %} * Current Implementation * Future Implementation * Past Implementation See the [Github Documentation for Rounds 1-8](https://github.com/gitcoinco/web/blob/master/docs/GRANTS.md) {% embed url="" %} # Governance # About Grants Round Governance After every Grants Round the Gitcoin team in collaboration with the community put together a governance retro blog post. We use it to outline the important governance decisions made throughout the round and who is making those decisions. It’s the goal of the Gitcoin Team to remain as credibly neutral as possible as we continue down the path of decentralizing Grants governance. Part of that is being transparent about the process, the people, and the decisions. Grants Rounds Governance Briefs also act as calls to action to the Community Stewards to ratify the round payouts. They provide round statistics, explanations of various types of malicious actions taken against the Quadratic Funding mechanism and how we responded, disputes and the review process, as well as lessons learned from the round. With the information contained in the Brief the Stewards can make an educated decision on whether or not to ratify the round. While preparing the GR10 Governance Brief, we found that policies and procedures regarding round governance evolved over time. And that in the interest of transparency it would be beneficial to have a separate doc outlining these policies and procedures that would be updated as they changed. That’s what this document is all about! # What are we protecting? We believe [Quadratic Funding](https://wtfisqf.com/?grant=\&grant=\&grant=\&grant=\&match=1000) is the optimal way of funding public goods in a democratic society. Gitcoin Grants employs QF as a funding mechanism for digital public goods, and to date is the largest implementation of QF on the planet. But QF does have vulnerability. It can be gamed through Sybil and Collusion attacks, which is why identity verification — for grant funders as well as project owners is vital. This document largely discusses how QF defense is governed including: * What is considered a malicious action, and who is defining it? * What remediation is being employed, and who is employing it? * What is the grant approval process, and who is responsible for it? * What is the appeals process and who is responsible? * How is the Gitcoin Team attempting to remain credibly neutral? * How decentralized is the current state of governance? # Why does Quadratic Funding through Gitcoin Grants matter? Gitcoin Grants gives the community an opportunity to help focus where funds are directed. This directly impacts how builder cycles are allocated. When community members send funds to a grant they are signalling their support for it, becoming a voice and a vote for its importance. Their participation determines how much of the match fund a grant receives, and because of QF, their vote has a quadratic impact. ![The Round 10 Preference Map. Each Node is a project or a person, and each edge is a funding transaction.](https://lh6.googleusercontent.com/-mC7L4O-W2DhuWKaH8ZZ5Lw_xU8Fd6KsawjySZl4iGr3Hxf0h7Ekv5p5MYVKLthu2wGsTti59IfkgItUxI_LLKQByVKgX1E5cyTrxROfc48wab6biw1itV7m6EuqFUfU_YYM8P4) Gitcoin Grants supports open web development, but beyond that, we view Gitcoin Grants as a vital experiment in Quadratic Funding. Testing QF is important because we believe it is the optimal way of funding public goods in a democracy, and could become a major approach to allocating public resources this decade and beyond. Each round offers more opportunity for our community to learn and test the system together, while the stakes get increasingly higher as the rounds become more successful. That is why it’s crucial as part of our quarterly Grants Round cadence to take pause and reflect on all aspects of the round — the accomplishments and challenges. In doing so, we learn how to better support the community in improving the integrity in the system and the transparency in the process. # Red Team vs Blue Team Quadratic Funding is amazing in how it amplifies the contributions of small donors, but it also comes with some open research problems to solve: namely how to prevent sybil attacks and collusion attacks. To learn more about Sybil and Collusion, [please watch these short videos](https://www.youtube.com/playlist?list=PLvTrX8LNPbPmkUTnZOZPfku5698_lHvma). {% embed url="" %} [We have partnered with BlockScience](https://gitcoin.co/blog/towards-computer-aided-governance-of-gitcoin-grants/) and the Token Engineering Commons to create an open community-data-review process so we can begin solving these problems to [deter adversarial behaviour at scale on Gitcoin Grants](https://gitcoin.co/blog/deterring-adversarial-behavior-at-scale-in-gitcoin-grants/). {% embed url="" %} While Gitcoin Grants is known primarily as a public goods funding mechanism, there is another way of looking at it. Grants Rounds are battlegrounds for pushing forward research in adversarial behaviour in digital identity-based funding mechanisms. If you look at it from a certain angle, Grants Rounds are giant red team / blue team exercises for battle-testing Quadratic Funding in the real world, with real value on the line. Our approach is iterative. Every round our goal is to build blue team’s fortitude by identifying and categorizing attacks from the red team, so that moving forward our community has defense against them. That way we can scale up the positive impact of QF. Grants Round 9 saw a marked uptick in attacks, both in number as well as approach — which makes sense given more participation and more funds on the line. There is simply greater and greater incentive to try to game QF as the matching pool grows. So in GR10, we adjusted our approach to defending QF, which we’ll discuss in more detail below. We view grant round integrity as a public good in itself, and so articulating what we’ve witnessed is an important priority for us. # Legitimacy as a North Star for Gitcoin Grants # Accepting Round Results Gitcoin uses quadratic funding to determine matching pool allocation to individual grants. This is a combination of the Quadratic Funding Algorithm, Pairwise matching, and Trust Bonus. But ultimately ratifying the round payouts is governed by the Community Stewards through a governance proposal and Snapshot vote. The payout transaction is then initiated by the multisig holders. In the future, the ratification vote will occur on-chain, and will trigger the payout transaction directly from the DAO’s treasury. # Making Policy Updates The systems by which content is entered into a database, not the process of approving Dao governance changes. Dao changes must go through the Gitcoin governance process including a Steward vote. Policy updates shall be entered in Gitbook as standard edit submissions (push request) where they shall be approved or denied by ??? Any member of the GitcoinDAO may suggest Policy changes here: XXXXXXX # Subjective Decisions # Accepting Workstreams # Stewards Role The Gitcoin Governance ecosystem is a delegated voting system (liquid democracy) which allows token holders to delegate their voting power to someone else. Community members who have had tokens delegated to them are Stewards, and may vote in on/off chain governance proposals. Token holders may delegate their voting power to themselves if they wish to participate as Stewards. Stewards who alone or with a group meet quorum (1mm token supply) may submit governance proposals that call for a vote. # Credible Neutrality Participation in Gitcoin Grants takes place on several abstraction layers, and each layer is governable. Since the end goal is governance entirely by the Community Stewards, we’ll need to decentralize governance of each layer, from the bottom up. Here are the efforts taken for Grants Round 10 Grants Round 10 saw governance play a large role. The Anti-Fraud Workstream developed oversight practices for the review of new grants and the adjudication of disputes. 1. We use the [@GitcoinDisputes](https://twitter.com/GitcoinDisputes) Twitter handle to communicate to and seek feedback from the community as we spot potential attacks. 2. We employ an [open & community driven data analysis process](https://twitter.com/tecmns/status/1371451763820171270) driven by BlockScience and the Token Engineering Commons through the [Anti-Fraud Workstream](https://gov.gitcoin.co/t/workstream-anti-fraud-workstream-assemble/158). 3. Prior to GR10, the Gitcoin Community Stewards [ratified round sizes](https://snapshot.org/#/gitcoindao.eth/proposal/QmRbuBUX7vtNhYwYqYG3Jd4LqaRXVM8qDgjNojGEAzJdnH) through snapshot vote. 4. Through a Snapshot vote the [Gitcoin Community Stewards ratified the creation of a new round](https://snapshot.org/#/gitcoindao.eth/proposal/QmZTskr6yb4tSF7Jnnvd5a2YsuJJBDveEv4hbK6QJM83SB) (Building Gitcoin), and accepted $50K from Gitcoin Holdings to fund it. 5. Through the Anti-Fraud Workstream, the community created a process of governing suspected fraudulent users and grants. As follows: # GitcoinDAO Role in Grants # Collection Levels & Participation Policies Think of the Platform as all of the grants that exist. If a grant is not allowed on the platform, it won't be approved for matching in any collection. There are two primary types of collections. They 1. **Ecosystem** - Subset of "All Grants on Platform". Has it's own matching pool & policy. 2. **Discovery** - Subset of grants in an Ecosystem. Can be given its own matching if the ecosystem allows for it. * **Sub-Rounds** like Infra, Dapp, Community are Discovery collections in the Ethereum ecosystem which are allocated a portion of the total matching for the round. * **User Collections** can be made by any user to highlight grants they think need to be supported. # Ecosystem Acceptance A subset of grants supported by a continuous matching pool. The ecosystem establishes their own norms & values. To use the Gitcoin Grants platform, the GitcoinDAO must approve of the ecosystem who is providing matching funding to a self-curated collection of grants. **This requires ratification by Steward Vote.** The Ethereum ecosystem is the one our quarterly grants rounds currently focus on. This ecosystem is supporting many open source software developers/orgs and creators who promote the building on or of Ethereum. The Ethereum ecosystem has also formed a split governance where the community multi-sig holders verify the work of GitcoinDAO as a check and balance. The GitcoinDAO is tasked with upholding the norms & values of the ecosystem. # Round Acceptance The rounds are specific time based instances of matching within an ecosystem. Each round includes all the grants allowed in the ecosystem hosting the round. GR10 is the Ethereum ecosystem round with matching from 6/16/21 - 7/1/21. # Sub-Round Acceptance A subset of grants allowed in the ecosystem and round which are eligible for a specific category of matching. (May be inclusive or exclusive - Set by ecosystem) In each quarterly grants round, the large matching pool is divided into sub-rounds. For example in GR10, the six sub-rounds were Infra Tech, dApp tech, Community, NFTs, dGov, LatAm. # Side-Round Acceptance A separate ecosystem using the hype of a larger round to promote an unrelated round. “Gitcoin Building Gitcoin” during GR10 - Funds for matching provided by Gitcoin Holdings, therefore they set the Ecosystem and Round participation policy. The GitcoinDAO stewards need to ratify the round per usual, but by identifying it as a "side-round" it notifies the explicit intent to piggyback on the larger ecosystem. # Grant Participation Policy The current rules come from the [Gitcoin Holdings Inc. Terms of Service](https://gitcoin.co/legal/terms) and the established norms of the community. The next step in progressively decentralizing is to have the stewards of GitcoinDAO ratify the entirety of this policy. New grants are all reviewed prior to being activated on the platform. Grants are evaluated for both their platform eligibility and for participation in the rounds they select. **There are multiple levels for approval.** Platform | Ecosystem | Round | Collection At each level, the participation policy allows for a subset of the grants at the higher level. # The Grant Approval Process Any user (logged into Gitcoin using their Github credentials) can create a new grant. The grant is visible to the community but not active in the round, and thus not eligible for matching funds. The Anti-Fraud & Collusion workstream of GitcoinDAO reviews each grant, approving or denying it. The verification process flow is below. ![](https://lh3.googleusercontent.com/ra0AHoVKFZIAGlHxDJIQRKYMUr1i4rvYnLNUGqzUvqvLNTnkhjrgrlI-6irveqFsETmQdcRjyQ5CAzOi7RuJ2cdY4CXvlw5T38-WMqOyo8qCmANnt6IfkdSKXe9uPGqN12gfUyA) In the past, the Gitcoin Team has sole review responsibility. For the first time in GR10 the community was incorporated into the verification process, along with a way for denied grants to appeal the community’s decision. For more information on grant activation and verification, [please read this article](https://support.gitcoin.co/gitcoin-grants/grantee-questions/why-isnt-my-grant-active): {% embed url="" %} # Platform Level Grant Participation Policy This policy is set and enforced by the Anti-Fraud & Collusion workstream of GitcoinDAO and is ratified by the GitcoinDAO stewards. No grant shall contain any of the following material: * **Fraud | Impersonation** - Claiming to be a brand or person you are not * **Hateful Content** - Racist, sexist, or otherwise hateful * **Deceiving Users** - Malicious content that could cause harm or unintended consequences to users * **Advertising** - Using grants to showcase something you are selling like a token sale or NFT drop # Ecosystem Level Grant Participation Policy All ecosystem policy is set by the contributors to the matching pool and/or the community the ecosystem serves. For the Gitcoin UI and ETH ecosystems this is entirely handled by the FDD workstream of GitcoinDAO. For side rounds like UNI, MATIC, or GTC, the FDD Workstream facilitates enforcement of policy set by the ecosystem hosting the side round. There are two types of ecosystems: 1. **Inclusive** - Grants must be approved to match the level policy, but defaults to inclusion. 2. **Exclusive** - Grants must be explicitly invited by the ecosystem. As an example of an **INCLUSIVE** ecosystem, the Ethereum Ecosystem | Round GR10 policy is ratified by the keyholders of the multi-sig wallet which holds the matching funds. The Ethereum ecosystem also uses the GitcoinDAO to set its policy. IINCLUSIVE - Anyone could make a grant and apply to The Gitcoin Building Gitcoin Ecosystem | Side Round to GR10. However, participation policy was ratified by Gitcoin Holdings Inc., the sole contributor to the matching funds. EXCLUSIVE - The GR8 ZCash ecosystem side-round policy was invite only to grants which were explicitly invited to the round by the entity which controled the matching pool funds for that round. The same would apply for any other exclusive ecosystem|round. # Side Round Ecosystem Policy Documentation # Ethereum Ecosystem Participation Policy (GR11, GR10, GR9, etc.) All the Platform Participation Policy plus * Avoid any form of quid pro quo that has financial value (a scenario in which a user gets some additional unique benefit/award in return for their donation). * No non-ethereum related projects **Non Ethereum related projects** ![](https://lh3.googleusercontent.com/FmA-OA4gmxHzekwzPCJXKoMXiF1YBlVs1BwAvl3-fjKlc3Gde_R_u4QiJ_ZqTbOH8RlSZMBT0Aik3IYT8QtDXslQbiHhpCR0mUUcaYN_fKochWyNPODRBBrYHn_xvsvWNEaD0-s) Every round Non-Ethereum projects seek to participate. This includes Web3 groups on other chains. In GR9 we saw our first Binance Smart Chain (BSC) grant from an NFT project called [ARTSTRO](https://gitcoin.co/grants/2434/artstro). **Gitcoin Action:** In earlier rounds the precedent was set to not allow grants for projects outside of Ethereum, so we disabled this grant. But whether or not to permit other chains is an open governance question for the community. * No multiple grants for one entity in different categories **Project with Multiple Grants in Different Categories.** There was a [dispute](https://twitter.com/GitcoinDisputes/status/1372315090515415042) raised on March 17th, 2021 regarding two grants: * EtherDrops (dApp Category) * DropsEarn (Community Category) Both projects are affiliated with the DROPS Foundation. If the grants had been in the same category, then [pairwise bonding](https://ethresear.ch/t/pairwise-coordination-subsidies-a-new-quadratic-funding-design/5553) would have muted the impact of both grants having similar contributors. But they were not. **Gitcoin Action:** The community went [back and forth with the founders of the DROPS Foundation](https://twitter.com/GitcoinDisputes/status/1372551235471958020), and ultimately decided that having similar grants from the same company dominating different categories with similar contributors, represented a threat to the legitimacy of the round. In response, the Gitcoin Team disabled matching on one (but not both) of the grants. # GitcoinDAO Ecosystem Participation Policy # All Exclusive Ecosystem Policy Documentation GTC - Gitcoin Building Gitcoin UNI - Uniswap * Matic Ecosystem Participation Policy * ZCash Ecosystem Participation Policy * Filecoin Ecosystem Participation Policy * Sia Ecosystem Participation Policy * Algorand Ecosystem Participation Policy * Binance Smart Chain Ecosystem Participation Policy # User Participation Policy The current rules come from the Gitcoin Holdings Inc. Terms of Service and the established norms of the community. The next step in progressively decentralizing is to have the stewards of GitcoinDAO ratify the entirety of this policy. Users are not reviewed upon activation on the platform. They are only reviewed when one of our detection mechanisms flags them as "presenting as fraudulent or sybil". Users in violation of the ToS or norms & values of an ecosystem may have their contributions effect on match allocations diminished or turned off. They may also be blocked from accessing the platform. **There are multiple levels for approval.** Platform | Ecosystem | Round | Sub-Round | Side-Round At each level, the participation policy allows for a subset of the users allowed at the higher level. **We cannot possibly enumerate every single literal example of a breaking of the above rule, so please treat the above list as an incomplete list. You should refer to the definitions of Sybil and collusion attack in the CLR paper as the canonical source of truth for the rules.** # Round User Participation Policy Round Participation is based on the settings for the ecosystem. # Ethereum Ecosystem User Participation Policy Documentation Same as the platform # Ecosystem Level User Participation Policy This policy is set by the contributors to the matching pool and/or the community the ecosystem serves. Currently, the product has only built the tools to diminish or turn off matching for the Ethereum Ecosystem or at the platform level. # Platform Level User Participation Policy This policy is set and enforced by the Anti-Fraud & Collusion workstream of GitcoinDAO and is ratified by the GitcoinDAO stewards. * **Fraud | Impersonation** - Claiming to be a brand or person you are not. **DO NOT MAKE UP A NEW IDENTITY TO CONTRIBUTE** * **Hateful Content** - Racist, sexist, or otherwise hateful * **Deceiving Users** - Malicious content that could cause harm or unintended consequences to users * **Advertising** - Using grants to showcase something you are selling like a token sale or NFT drop * **Quid Pro Quo/Bribery** - DO NOT offer anyone a quid-pro-quo (especially one that has financial value) for a contribution. * **Falsification** - Any type of hacking to falsify a contribution is prohibited. # User Disputes, Sanctions, and Appeals There isn't currently a public oversight page for user sanctions due to PII data & potential vulnerabilities. The review of User sanctions is done by the [Fraud Detection & Defense](https://www.notion.so/Fraud-Detection-Defense-f1a2969a9f324f57a02ef69a60b25cae) workstream of GitcoinDAO. Any user may appeal their situation in the Gitcoin-Disputes Discord channel. **Gitcoin DAO reserves the right to deny service to anyone at anytime for any reason.** # Understanding Potential Attack Vectors # Fraud/Impersonation ![](https://lh3.googleusercontent.com/G7OMn4K3OYARK2Rp1OX0mSE0o9aeBO9wh1_iYA5CegF2J3w7Xo-SZoXswd1tCdt7ORqm0JObo_N_Kb4Kyho8KaMUtE9qrmMox4nHbWJTvElo7RUZ7h-TGWPR64u6mzcFWeXxKBY) **Gitcoin Action**: We were notified by a community member through @GitcoinDisputes that this is a fraudulent grant. We verified it as fraud with the project lead, and disabled it. * Hateful Content * Advertising * Ethereum Ecosystem * Understanding the community norms * Bribery/Quid Pro Quo # Collusion Attack We define collusion per the CLR Paper as > The central vulnerabilities of LR, as with other mechanisms designed based on the assumption of unilateral optimization, are collusion and fraud. Collusion takes place when multiple agents act in their mutual interest to the detriment of other participants. Fraud takes place when a single citizen misrepresents herself as many. {% embed url="" %} {% embed url="" %} # Sybil Attack We define a Sybil attack per > In a Sybil attack, the attacker subverts the reputation system of a network service by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence. It is named after the subject of the book Sybil, a case study of a woman diagnosed with a dissociative identity disorder. {% embed url="" %} {% embed url="" %} # Bribery/Quid Pro Quo **Attack**: Blockchain technology offers unprecedented, decentralized transactional transparency, which is necessary for trustless coordination. But it can also lead to instances of bribery that could sway the QF algorithm to benefit a particular org. For example projects have promised token airdrops to users who have given to their grant. This is a form of quid pro quo in exchange for collusion to maximize their matching fund distribution, which is possible because send addresses are public. ![](https://lh4.googleusercontent.com/FU9K8CWHLHMTQHY6kwldPxa6pPiJER9h1_GWmfYq5GEwlWN26gBm_MVLxrC6jJGy0ygIbol8sLjYvxQVFIJN0NnDjjrxb2n9pGA2NhlQ70gK1hEKu_YlPerlHyKxJDb7vCcDJRo) However, not all airdrops are malicious. [In this example](https://docs.sato.trade/sato-staking/getting-sato) an Ethereum project offered tokens for anyone who participated in Gitcoin Grants, no matter which grants they funded. But regardless of the intent, this behavior also may cause unintended consequences. If airdrops for Gitcoin Grants participants become common, users may employ bots to donate a small amount to many grants in the hopes of token profits later on. It is worth noting that sometimes bribes are not explicitly offered, but can still be problematic even when they are implied, as is [the case with Minerva](https://gitcoin.co/grants/1110/minerva-wallet-lab10-collective-panvala-league). While not promising tokens, they do make a point to mention they will soon have one. It’s reasonable to believe they are implying that anyone participating in their grant now, will receive tokens in the future. This grey area is something we continue to work with the community stewards to define policy on. Another consideration is what effect bots donating might have on the quadratic funding mechanism. Sybil accounts using bots to donate to a collection of grants they think are most likely to offer a token airdrop would skew the payouts from the matching pool. A bot that donates evenly across all grants would not have this same effect. **Gitcoin Action**: In the case of an explicit bribe in which a quid-pro-quo is offered and a smoking gun evidence for the same is presented, we will take action to remove the grant from the matching pool. In cases in which bribes are not explicit, then we expect resolution will come through a formal community governance process. * Well-Funded Grants & Community Self Policing Grants Round 9 also presented an interesting concern that does not fall into an attack category, but did raise questions of legitimacy from the community. Maskbook is a fully funded Web3 project who sponsored the GR9 Hackathon. They released their token in February, 2021 which included a retroactive distribution to anyone who supported their grant in previous rounds. The controversial part of this is at the time Maskbook still had an active grant. So the community questioned whether or not it is appropriate for funded projects to participate in grants rounds and benefiting from QF matching, particularly if they had set a precedent for rewarding past grant contributors. In this case Maskbook acted quickly and stopped accepting matched funds, which seems in line with the expectations of the Ethereum community. Another example is [Vocdoni](https://twitter.com/vocdoni/status/1374415073666502667) who also had an active grant, but proactively stopped accepting funds from the match pool after their financial future was secured late last year. Both examples show the community was willing to police itself so that direct intervention from the Gitcoin Team was not necessary. This is an important observation to note. The more the community rewards good actors, and deters bad actors, the less the Gitcoin Team needs to be involved in governance decisions. **Gitcoin Action**: In the case in which a grant owner decides to remove their grant from matching, we will do it for them. Right now there is no policy against grants having business models, token models, or VC fundraising, but in the future community stewards (in cooperation with the Gitcoin community as a whole) could create one if they wanted. # Active Defense Measures # Sybil Detection by Machine Learning #### Machine Learning Flagging & Community Review Process **Our Machine Learning Flagging & Community Review Process is designed to prevent sybil attacks.** In addition to the proactive measures above, we have been working with BlockScience on a reactive machine learning pipeline that gives a score to each contribution, and informs the community stewards what contributions to look out for. BlockScience [has been posting on the Gitcoin blog](https://gitcoin.co/blog) with details about what they’ve been working on, and will be posting a blog post about this pipeline as it develops. ![](https://lh6.googleusercontent.com/_r_g5FwYX7lAXWhNV-9J4ipalDvjmIrIzpfZeuAApUhlLoI5QJwHGKzhmYUEYvAyiEGk_uSkeOfeDhWaxVz9CEg5Rox23UIiWo6lszwRYciXOd6g1cuutwuoN3oQLUuVgEVk5LU) # The Gitcoin Mission Gitcoin creates technologies and opportunities that enable communities to build, fund and protect what matters. # Contact Us We understand that sometimes you may need help or have questions regarding our products or services. That's why we have made it easy for you to contact our support team. There are two ways to reach us: through email and live chat on our websites. ### Email Support For assistance via email, direct your queries to the appropriate address based on the nature of your inquiry: * For questions related to Passport, please email us at * For inquiries concerning Gitcoin Grants or any other matters, reach out at Our dedicated support team aims to reply to all emails within 24 hours on business days. To ensure we can provide the most effective support, please include detailed information about your issue or question in your message. ### Live Chat Support We also offer live chat support on our website. To access this feature, simply click on the chat icon located at the bottom right corner of our websites, including this page. You can find our live chat widget on: * * * * * Our support team is available to assist you from 9 AM to 5 PM GMT, Monday through Friday. While we have less capacity on the weekends, we do our best to help. When you initiate a chat with us, you will be connected with one of our support team members. Please note that our live chat support is available only during our business hours. # GTC Delegation # Quadratic Lands Token Distribution web3 support- Signed Message Vote If you choose to not delegate your voting power to a steward (power to the people FTW!) you will be asked to help chart the future of Gitcoin by proving feedback on the development road map. You will be prompted to sign a message with your active Ethereum account to solidify your preference. This signed message does not require any gas fees and is not being broadcast on-chain for now. While it's possible that Gitcoin could use these signed messages as a foundation for a future airdrop or something, for now, we're just collecting these votes up to help us better understand what direction the Gitcoin community would like to see Gitcoin go. # Quadratic Lands Token Distribution web3 support- Token Claim After completing the first two missions (1-proof of knowledge and 2- proof of use) eligible users will arrive at the third mission, proof of receive. When you click `claim` in the receive mission, you will be prompted to broadcast a transaction to the Gitcoin Token Distribution contract. If you are having issues with your token claim please here are a few things to check/confirm: 1. your wallet is connected to the Ethereum Mainnet 2. you don't have any old/stale transactions pending transactions on your account 3. you have enough Ethereum in your account to cover the gas fees # Quadratic Lands Token Distribution web3 support-Delegate Voting Power After you've successfully claimed your airdrop (or even if a friend sent you tokens and/or you acquired them elsewhere you can delegate your voting power using the [`Stewards interface`](https://gitcoin.co/quadraticlands/stewards) in the Quadratic Lands [🗳️](https://emojipedia.org/ballot-box-with-ballot/) {% embed url="" %} This is a relatively straightforward web3 interaction in which you will call the `delegate` function on the **GTC token contract** [`0xde30da39c46104798bb5aa3fe8b9e0e1f348163f`](https://etherscan.io/address/0xde30da39c46104798bb5aa3fe8b9e0e1f348163). If you're having issues delegating through the Quadratic Lands UI you can also try delegating voting power using our [Tally interface](https://www.tally.xyz/gov/eip155:1:0xDbD27635A534A3d3169Ef0498beB56Fb9c937489) or even with [Etherscan](https://etherscan.io/address/0xde30da39c46104798bb5aa3fe8b9e0e1f348163f#writeContract). # cGrants/Bounties & Hackathons Sunsetting FAQ After an incredible journey, we're bidding farewell to our old website and sunsetting the cGrants platform. Users will have until **July 30th, 2023** to retrieve their data from the old platform. cGrants - the site where we hosted our bounty platform and first QF grants platform - has served us well, allowing us to foster innovation and support talented individuals. {% content-ref url="/pages/RYH566mMeOEma17jFKEK" %} [What’s happening to the Hackathons and the Bounties program?](/gitcoin-knowledge-base/misc/cgrants-bounties-and-hackathons-sunsetting-faq/whats-happening-to-the-hackathons-and-the-bounties-program) {% endcontent-ref %} {% content-ref url="/pages/W8FwYgf2FTdbSh5JgpJ4" %} [How to retrieve my data from cGrants](/gitcoin-knowledge-base/misc/cgrants-bounties-and-hackathons-sunsetting-faq/how-to-retrieve-my-data-from-cgrants) {% endcontent-ref %} {% content-ref url="/pages/OLWIT8UuMbtlTFM3saCn" %} [What is happening to my data?](/gitcoin-knowledge-base/misc/cgrants-bounties-and-hackathons-sunsetting-faq/what-is-happening-to-my-data) {% endcontent-ref %} # What’s happening to the Hackathons and the Bounties program? For years Gitcoin has been known for it’s hackathons and bounties program. Moving forward, this part of Gitcoin’s business will be taken over by [Buidlbox](https://buidlbox.io/), giving space for Gitcoin to focus on it’s Gitcoin Grants Program and [suite of products](https://twitter.com/gitcoin/status/1670892624008364032). The same hackathons and bounties programs you’ve come to benefit from and enjoy can still be access through [Buidlbox](https://buidlbox.io/). # How to retrieve my data from cGrants ### What to do: * Visit [https://bounties.gitcoin.co/grants](https://t.co/fmBOfs1aBP) * Sign into your account (as the grant owner) * At the end of the page you'll see the "stats." There's a dropdown to download the csv * Need further help? Reach out to our team in the chat window on the bottom right corner of this site. As we say goodbye to cGrants, we express our deepest gratitude to everyone who contributed to this first chapter of our adventure with Quadratic Funding, as well as those who took advantage of our bounty platform. Now it's time to embrace a new chapter as we transition to a more dynamic future with [Allo Protocol](https://allo.gitcoin.co/), [Gitcoin Passport](http://passport.gitcoin.co) and [Gitcoin Grants Stack](http://gitcoin.co/grants-stack). Be sure to check out our [new website](https://t.co/VaZA3gwz1i) to learn more about these game-changing projects. Also, check out the amazing work being done by the [Buidlbox](https://buidlbox.io/) team, who are taking the old bounty platform and elevating it to the next level. Remember, you have until **July 30, 2023** to retrieve any data you want to keep - bounties, payment history, etc. After that, your information will no longer be available. # What is happening to my data? Your data is still available for download until July 30th. At that point in time we will be officially sunsetting our cGrants platform for good. # Gitcoin Governance Get answers to questions commonly asked about GitcoinDAO. We've curated a collection of the most commonly asked general questions about how Gitcoin's governance works. Don't see an answer to the question you have? Let us know by reaching out on [the Gitcoin Discord](https://discord.com/invite/b5PEjyVFXT), and we'll consider adding it. ### Governance {% content-ref url="/pages/4MRbIdEzjOCll7pi5FAf" %} [Broken mention](broken://pages/4MRbIdEzjOCll7pi5FAf) {% endcontent-ref %} {% content-ref url="/pages/r0vz1nfrm3vRjFQk8ZaR" %} [What is the Stewards delegation program?](/gitcoin-knowledge-base/misc/dao-faq/what-is-the-gitcoin-stewards-delegation-program) {% endcontent-ref %} {% content-ref url="/pages/MuIeX8jGBt3VHAVgL9yW" %} [Who chooses Stewards?](/gitcoin-knowledge-base/misc/dao-faq/who-chooses-stewards) {% endcontent-ref %} {% content-ref url="/pages/rhmpTc1HQKAEQJugHXDD" %} [How do I get involved in Gitcoin governance?](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-get-involved-in-governance) {% endcontent-ref %} {% content-ref url="/pages/jrQSDKYmS0xR3Kregsfv" %} [How do I become a Gitcoin Steward?](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-become-a-gitcoin-steward) {% endcontent-ref %} ### Did we answer your question? Don't see an answer to your question? [Join the Gitcoin Discord](https://discord.gg/b5PEjyVFXT) or [submit a ticket to support](https://gitcoin.happyfox.com/new). # What is the Stewards delegation program? Learn more about how the Steward delegation program helps governance in the GitcoinDAO. One of the largest challenges of token governance was maintaining an active community of voters, which is crucial for legitimacy. Gitcoin launched a liquid democracy through the Stewards delegation program to combat this. ## The Stewards delegation program ### GTC Any address holding GTC has voting rights in GitcoinDAO proportional to the number of GTC tokens it holds. Many community members hold their GTC because they are interested in GitcoinDAO succeeding in its mission, but they might not want the responsibility of following every detail within the DAO or participating in every vote. ### Stewards Stewards are active community members who participate in governance on behalf of GTC holders (delegates). The community directly determines the influence of a Steward by delegating GTC to them. The more voting rights assigned to them, the more trust the community has in their stewardship. Many of Ethereum’s most trusted members have volunteered to be Gitcoin Stewards, but anyone can become a Steward. ## Further reading * [Introducing Stewards Governance](https://gov.gitcoin.co/t/introducing-stewards-governance/41) * [Introducing Steward Health Cards 2.0](https://gov.gitcoin.co/t/introducing-steward-health-cards-2-0/) ## Related topics {% content-ref url="/pages/MuIeX8jGBt3VHAVgL9yW" %} [Who chooses Stewards?](/gitcoin-knowledge-base/misc/dao-faq/who-chooses-stewards) {% endcontent-ref %} {% content-ref url="/pages/oVRxK9Lfsy7WfVw6eE6u" %} [Broken mention](broken://pages/oVRxK9Lfsy7WfVw6eE6u) {% endcontent-ref %} # How do I get involved in Gitcoin governance? ## How to get involved * Join [Gitcoin Discord](http://discord.gg/gitcoin) to engage with the community! * Participate in governance proposals on [the Gitcoin governance forum](https://gov.gitcoin.co/). * If you have tokens, delegate them to a Steward or to yourself if you wish to participate as a Steward. * Vote on [Snapshot](https://snapshot.org/#/gitcoin), then vote on [Tally](https://www.withtally.com/governance/gitcoin). ## How to delegate GTC to yourself or Stewards ### Delegate to yourself 1. Go to [ https://www.tally.xyz/gov/gitcoin](< https://www.tally.xyz/gov/gitcoin >).
2. Connect your wallet containing GTC.
3. Press “Delegate vote” button and select the option “Delegate to myself”.
4. Confirm the transaction.
### How to delegate to a Steward 1. Go to .
2. Choose a Steward and select "Delegate".
3. Connect your wallet containing GTC to the website.
4. Confirm the transaction. \
## Further reading * [Gitcoin DAO Governance Process v3](https://gov.gitcoin.co/t/gitcoin-dao-governance-process-v3/) ## Related topics {% content-ref url="/pages/jrQSDKYmS0xR3Kregsfv" %} [How do I become a Gitcoin Steward?](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-become-a-gitcoin-steward) {% endcontent-ref %} # Who chooses Stewards? Learn more about who chooses the people who help make decisions and vote on the future of GitcoinDAO. ## What is a Steward? A Steward helps guide GitcoinDAO by engaging in the Gitcoin governance process and voting on behalf of those who have delegated their voting power to them. ## Who chooses Steward? Technically, anyone can nominate themselves to [become a Steward](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-become-a-gitcoin-steward). However, the impact Steward's have is determined by the amount of GTC they have been delegated by the community support. The Stewards with the most voting power are those who the community have signalled [Learn to delegate your GTC to a Steward.](broken://pages/oVRxK9Lfsy7WfVw6eE6u) ## Further reading * [Introducing Stewards Governance](https://gov.gitcoin.co/t/introducing-stewards-governance/41) * [Introducing Steward Health Cards 2.0](https://gov.gitcoin.co/t/introducing-steward-health-cards-2-0/) ## Related topics {% content-ref url="/pages/ajYHI7zVPS0QCjrvQE6S" %} [Broken mention](broken://pages/ajYHI7zVPS0QCjrvQE6S) {% endcontent-ref %} {% content-ref url="/pages/oVRxK9Lfsy7WfVw6eE6u" %} [Broken mention](broken://pages/oVRxK9Lfsy7WfVw6eE6u) {% endcontent-ref %} {% content-ref url="/pages/jrQSDKYmS0xR3Kregsfv" %} [How do I become a Gitcoin Steward?](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-become-a-gitcoin-steward) {% endcontent-ref %} # How do I become a Gitcoin Steward? Learn the steps you need to take to become a representative for others in GitcoinDAO. Becoming a Gitcoin Steward is a permissionless process; anyone can self-nominate. But, despite that, it comes with great responsibility. If you'd like to become a Steward, read more about the process below. ## Step 1: **Contemplate the responsibilities of Stewards** To become a Gitcoin steward, the first question you should ask is whether you want the responsibility. Being a Gitcoin Steward is a serious responsibility—delegates are entrusting you with their votes. As a Steward, you must: keep up to date with the DAO, engage in governance discussions, and analyse, solicit input, and vote on proposals. Become a steward to help fund more public goods, not for a title. [Watch a talk from Schelling Point Amsterdam on the responsibilities of Stewards](https://www.youtube.com/watch?v=C_RYqnZAYnM). ## **Step 2: Get to know GitcoinDAO** Although contributing to GitcoinDAO is not a requirement to be a steward, at least understanding the work that workstreams undertake daily is necessary to make informed choices in the governance process. [Join GitcoinDAO on Discord](https://discord.com/invite/uYcVFDchRJ) ## Step 3: Participate in the governance forums Getting involved in the forums is a high signal way to show your dedication to Gitcoin’s mission. Many of the most interesting conversations about Gitcoin happen here, from chatter on [meta-governance](https://gov.gitcoin.co/c/governance-meta/) and [governance proposals](https://gov.gitcoin.co/c/governance-proposals/) to specific [workstream discussions](https://gov.gitcoin.co/c/workstream-discussion/). [Read the Gitcoin governance forums](https://gov.gitcoin.co/) ## Step 4: Nominate yourself to become a Steward Becoming a Steward is a permissionless process. Nominate yourself on the [Steward nominations post](https://gov.gitcoin.co/t/introducing-stewards-governance/41), and you’re officially a Steward! Be thoughtful in your self-nomination—the difficult part is convincing fellow community members that you are one they should trust with their votes. [Read the Steward’s nominations](https://gov.gitcoin.co/t/introducing-stewards-governance/41) ## **Step 5: Participate!** The hardest part of being a Steward is showing up. The more effort you put in as a Gitcoin Steward, the more likely you will be delegated votes in the future. The MMM workstream created the Steward health cards to signal to delegates which Stewards are most involved in governance. [More on Steward Health Cards](https://gov.gitcoin.co/t/introducing-steward-health-cards-2-0/) Check out the [Steward Health Cards](https://www.daostewards.xyz/) ## Further reading * [Introducing Stewards Governance](https://gov.gitcoin.co/t/introducing-stewards-governance/41) * [Gitcoin DAO Governance Process v3](https://gov.gitcoin.co/t/gitcoin-dao-governance-process-v3/) * [Introducing the Steward Council](https://gov.gitcoin.co/t/introducing-the-steward-council/) * [Introducing Steward Health Cards 2.0](https://gov.gitcoin.co/t/introducing-steward-health-cards-2-0/) ## Related topics {% content-ref url="/pages/MuIeX8jGBt3VHAVgL9yW" %} [Who chooses Stewards?](/gitcoin-knowledge-base/misc/dao-faq/who-chooses-stewards) {% endcontent-ref %} {% content-ref url="/pages/rhmpTc1HQKAEQJugHXDD" %} [How do I get involved in Gitcoin governance?](/gitcoin-knowledge-base/misc/dao-faq/how-do-i-get-involved-in-governance) {% endcontent-ref %} # Gitcoin Security Bounty Program Gitcoin Security Bounty Program Responsible Disclosure Policy & Bug Bounty Guidelines Version 2.0 | Effective: Oct 2026 | Scope: https\://gitcoin.co ### 1. Purpose & Mission Gitcoin is an open-source marketplace that funds public goods and connects developers with meaningful work. We manage real economic value on behalf of our users — including grant funding, bounty payouts, and contributor rewards. The security of our platform directly protects that value. This Security Bounty Program exists because we believe the security community plays a critical role in keeping our platform safe. Responsible researchers who identify and privately disclose vulnerabilities protect our users before malicious actors can exploit them. In recognition of that contribution, we compensate researchers fairly for valid, in-scope findings. We are committed to acting in good faith toward researchers who act in good faith toward us — acknowledging your reports promptly, communicating our findings clearly, and paying bounties in a timely manner once vulnerabilities are confirmed. ### 2. Program Scope The bounty program applies exclusively to the primary Gitcoin web application and its authenticated/unauthenticated surfaces. Only the following domain is in scope: (all paths under the primary domain) **Out of Scope** The following are explicitly excluded from the program: * Subdomains not operated by Gitcoin (e.g., third-party integrations) * Third-party services (Slack, WordPress, Intercom, cloud infrastructure providers, etc.) * Vulnerabilities in past/unsupported versions of the software * Issues affecting only deprecated features with documented end-of-life * Bugs requiring physical access to a user's device * Vulnerabilities affecting only outdated browsers (EOL browsers, IE 11, etc.) ### 3. Vulnerability Severity & Payout Severity is assessed using the OWASP Risk Rating Methodology, which evaluates both the likelihood of exploitation and the impact on users, data, and platform integrity. The Gitcoin security team makes all final determinations on severity and payout eligibility. **Payout Schedule**
SeverityDescriptionPayout (USD)
CriticalFull account takeover, authentication bypass, RCE, mass data exfiltration, payment/fund manipulation$800
HighSignificant data exposure, privilege escalation, stored XSS impacting many users, IDOR with broad impact$420
MediumLimited data leaks, CSRF on sensitive actions, reflected XSS, SSRF with limited impact$200
LowInformation disclosure, low-impact CSRF, self-XSS requiring unusual conditions, minor logic flaws$50
Payouts are made in USDC. You must provide a valid Ethereum wallet address when submitting a report. Payouts will only be made to the first researcher who submits a qualifying report for a given vulnerability. ### 4. Eligible Vulnerability Types The following represent examples of in-scope vulnerability classes. This list is not exhaustive — any significant, novel vulnerability affecting the platform's security may qualify. * **Remote Code Execution (RCE):** Any vulnerability allowing arbitrary code execution on Gitcoin infrastructure. * **SQL Injection:** Injections that expose, modify, or destroy database contents. * **Authentication & Session Bypass:** Flaws allowing unauthorized access to accounts or bypassing login controls. * **Broken Authorization / IDOR:** Accessing or modifying resources belonging to other users. * **Privilege Escalation:** Gaining elevated permissions beyond what is authorized. * **Stored Cross-Site Scripting (XSS):** Persistent script injection affecting other users. * **Reflected Cross-Site Scripting (XSS):** Non-persistent script injection with meaningful user impact. * **Cross-Site Request Forgery (CSRF):** Forcing authenticated users to perform unintended actions. * **Server-Side Request Forgery (SSRF):** Making the server issue requests to internal or external systems. * **Sensitive Data Exposure:** Unintended disclosure of PII, credentials, tokens, or financial data. * **Business Logic Flaws:** Manipulation of application flows to gain unintended financial or platform advantages. * **Mass Assignment / Parameter Pollution:** Modifying object properties not intended to be user-controlled. * **Open Redirect (to phishing):** Redirects that enable credential harvesting from Gitcoin's domain. ### 5. Ineligible Issues The following will not qualify for a payout under any circumstances: * Denial of Service (DoS/DDoS) attacks or rate limiting * Social engineering, phishing, or spear-phishing attacks * Physical access attacks * Self-XSS (requires the victim to execute the payload themselves) * Clickjacking without a demonstrable, high-impact attack chain * Man-in-the-Middle (MiTM) attacks requiring local network access * Cache poisoning without meaningful user impact * Missing security headers without a demonstrated exploit * Missing DNS records (SPF, DMARC, etc.) without demonstrated exploit * Brute force attacks against login or other endpoints * Vulnerabilities in third-party services or platforms not operated by Gitcoin * Stack traces, verbose errors, or debug information without exploitable impact * SSL/TLS configuration issues without a practical attack scenario * Open ports without a demonstrated exploit path * CSV injection / formula injection without a practical attack * Automated scan results submitted without a proof of concept ### 6. Submission Process & Flow Follow the steps below to submit a report. Reports that do not follow this process, or that are disclosed publicly before a fix is deployed, will be disqualified. **Step 1 — Verify the issue** Confirm the vulnerability exists, is reproducible, and falls within the scope defined in Section 2. Do not test on accounts or data you do not own. **Step 2 — Prepare your report** Write up a complete report using the template in Section 7 below. Ensure your proof of concept is clear, reproducible, and does not cause data loss or service disruption. **Step 3 — Submit via email** Email with the subject line: \[SECURITY] \. Encrypt your email if it contains sensitive credentials or PII. **Step 4 — Await acknowledgment** You will receive an acknowledgment within 7 business days confirming receipt and providing a reference ID. Do not follow up before this window closes. **Step 5 — Triage & severity review** The Gitcoin security team will reproduce your finding and assess severity using the OWASP Risk Rating Methodology. You will receive a triage decision within 14 business days of acknowledgment. **Step 6 — Remediation** Gitcoin will work to remediate validated findings within the SLA defined in Section 8. We may request your assistance testing the fix prior to deployment. **Step 7 — Payout** Once the fix is confirmed and deployed, your bounty will be issued in USDC at the end of that calendar month. **Step 8 — Coordinated disclosure** After remediation is complete, you are free to publish your research. We ask that you coordinate the timing with the Gitcoin team and give us at least 30 days after fix deployment before public disclosure. ### 7. Required Report Template All submissions must include the following information. Incomplete reports will be returned for revision and may lose priority in the queue. **Vulnerability Title:** *A concise, descriptive title (e.g., "Stored XSS in grant description field allows session hijacking")* **Severity (Self-Assessed):** *Critical / High / Medium / Low — based on the OWASP model. Include your reasoning.* **Affected URL / Endpoint:** *The exact URL(s) or API endpoint(s) where the vulnerability exists.* **Vulnerability Type:** *The CWE or category (e.g., CWE-79 XSS, CWE-89 SQL Injection, CWE-352 CSRF).* **Description:** *A clear explanation of the vulnerability: what it is, why it exists, and what an attacker can do with it.* **Impact:** *The realistic worst-case impact if exploited in production — who is affected, what data is at risk, what actions can be taken.* **Steps to Reproduce:** *A numbered, step-by-step walkthrough that allows the Gitcoin team to reproduce the issue independently. Include all required preconditions (e.g., account type, specific page state).* **Proof of Concept:** *One or more of the following: screenshot(s), screen recording, working exploit code, or a test payload. PoC must be non-destructive and must not access real user data.* **Suggested Remediation:** *(Optional) Your recommendation for fixing the issue.* **Your Ethereum Address:** *Required for payout.* **Discovery Date:** *When you first identified this vulnerability.* **Tools Used:** *(Optional) Any scanning tools, browser extensions, or proxies used during research.* ### 8. Service Level Agreements (SLAs) Gitcoin commits to the following response timelines for valid, in-scope reports. All timelines are in business days from the date of original submission.
MilestoneAll SeveritiesCritical (Expedited)
Initial Acknowledgment7 business days3 business days
Triage & Severity Confirmed14 business days7 business days
Fix Deployed (Critical)—30 calendar days
Fix Deployed (High)60 calendar days—
Fix Deployed (Medium / Low)90 calendar days—
### 9. Researcher Guidelines Participation in this program requires adherence to the following rules. Violations will result in immediate disqualification and may be reported to law enforcement. **You Must:** * Use only your own account(s) for testing in the production environment. * Obtain written permission before testing on any account other than your own. * Stop testing immediately if you accidentally access another user's data, and disclose this access in your report. * Provide enough detail for the Gitcoin team to reproduce and fix the issue. * Maintain strict confidentiality — do not share, publish, or discuss the vulnerability until a fix is deployed. * Coordinate public disclosure timing with the Gitcoin team (minimum 30 days post-fix). **You Must Not:** * Access, download, modify, or destroy data belonging to other users. * Execute attacks that degrade service availability (DoS, DDoS, resource exhaustion). * Conduct social engineering or phishing attacks against Gitcoin employees or users. * Exploit vulnerabilities beyond the minimum necessary to prove impact. * Disclose any vulnerability publicly or to any third party before remediation. * Use automated scanning tools in ways that impact production performance. * Make threats, ransom demands, or use unprofessional language in any communications. * Submit reports for issues already known to the Gitcoin team or submitted by another researcher. The Gitcoin team retains sole discretion over all bounty determinations, including severity classification, payout amounts, and eligibility. We value good-faith researchers and will treat them accordingly. ### **10. Contact** Submit all security vulnerability reports privately and directly to: Subject line format: \[SECURITY] \ Reports must not be submitted publicly, posted to social media, filed as GitHub issues, or shared with any third party. Public disclosure of a vulnerability before a fix is deployed will automatically disqualify the submission from any payout. *Gitcoin Security Bounty Program v2.0 | | * # Passport The Gitcoin Passport support knowledge base has moved to a new location. Please head to the link included in this page to learn more. Gitcoin [announced](https://gov.gitcoin.co/t/gitcoin-entering-the-end-game/17560#passport-early-thinking-on-spin-out-7) that Passport will spin out of the DAO and become its own entity. As such, we have migrated the Passport support knowledge base to a new location. To learn more about Passport, please visit the following site: {% embed url="" %}