Report a vulnerability

Found a vulnerability? Tell us before you publish it.

How to report

Email info@shibaclassic.io with the subject "Security". Tell us where the bug is (address, program ID or URL), how to reproduce it and what it allows. We reply within 7 days.

In scope

• the website shibaclassic.io and the Telegram Mini App, including game scores and the leaderboard
• our contracts and programs: the bridge (LayerZero OFT), IncomeRouter, ClaimVault, the marketplace and the Solana programs. Today they run on testnets (Sepolia, Solana Devnet).

Out of scope

• the SHIBC token contract on Ethereum. It is renounced and can no longer be changed. A report helps us warn holders, but it is not rewarded.
• price moves or low liquidity. That is not a vulnerability.
• spam, phishing, social engineering
• denial of service against our sites or against third-party RPC endpoints
• contracts of other projects (Uniswap, LayerZero, Aragon). Please report those to them.

Rules

• Never test against other people's funds on mainnet. Use a testnet or a local fork.
• Do not view, change or delete other users' data.
• Give us 90 days to fix the issue before you publish it.

Reward

There is no treasury to pay from yet. Until there is, we credit you publicly if you want. A reward is possible, at our discretion and without a promise.

Once the treasury exists, this rule applies:

• Critical and High (funds can be lost): 10% of the funds at risk, at most 10% of the treasury and at most 50,000 USD, at least 50 USD. Paid in ETH or a stablecoin.
• Medium and Low: a small fixed amount
• Informational (for example missing events, gas, style): no reward, credit only

At risk is what the affected contract holds on the day your email arrives. For the bridge, it is the balance of the lockbox on Ethereum. How severe a finding is, the maintainer decides today, later the DAO. We pay within 30 days.