Report a security issue

If you find a security issue, tell us before you tell anyone else. Send it to support@asymmetra.xyz with the subject line Security report. Reports of any kind are welcome. Good-faith research is welcome.

​

What to send

• What the issue is, and what an attacker could do with it.
• Where it is: the program and instruction, the SDK function, the page or the endpoint.
• The steps to reproduce it. A run on a local validator or a mainnet fork is the best proof.
• Your contact, and the name to credit if you want credit.

​

What we ask

• Report privately, and give us reasonable time to fix the issue before you publish.
• Prove the issue with the least harm. Use your own funds and the smallest stake. Do not take or move funds that are not yours.
• Do not run a denial-of-service or spam test against the live programs, the price service or the apps.
• Do not use social engineering against our team, our users or our providers.
• Do not read, change or keep other people’s data.

​

What we do

• We confirm that we have your report within three business days.
• We tell you what we found and what we will do about it.
• We credit you when the fix is public, if you want that.
• We will not take action against research that follows this page.

​

Rewards

Rewards are at our discretion, and they depend on how critical the finding is. The findings we care about most are the ones that put trader funds or pool funds at risk, or that let someone stop trading or settlement. A finding of that kind is the kind that earns a reward. Lower-severity findings are still welcome, and we fix them. They do not usually earn a reward. That includes ordinary website issues, SDK bugs that put no funds at risk, and best-practice suggestions. There is no fixed table of amounts.

​

Scope

Not in scope:

• Services we do not run: wallets, RPC providers, exchanges and the Solana network.
• Anything that needs the victim’s own device or key to be compromised first.
• Limits that are already stated on the risk page.