This repository contains fund-moving Soroban smart contracts deployed on the Stellar network:
- bounty_escrow — see
docs/bounty_escrowfor contract-specific documentation. - program-escrow — see
docs/program-escrowfor contract-specific documentation. - grainlify-core — see
docs/grainlify-corefor contract-specific documentation. - sdk — see
docs/sdkfor integration/client-library documentation. - soroban — see
docs/sorobanfor contract-specific documentation.
Vulnerabilities in any contract deployed from this repository are in scope, including logic errors, access-control bypasses, arithmetic/overflow issues, and reentrancy or cross-contract callback vulnerabilities.
Current deployment addresses and networks (mainnet/testnet) for each contract will be listed under deployments/ as they go live. This directory is not yet populated — until a contract has a recorded deployment there, treat reports against it as pre-production/best-effort rather than a confirmed live-fund vulnerability.
Contact: security@PLACEHOLDER-please-fill-in.example (placeholder — needs a maintainer to confirm a real, monitored channel)
To report a suspected vulnerability:
- Do not open a public GitHub issue describing the vulnerability.
- Email the contact above with:
- A description of the vulnerability and its potential impact.
- Steps to reproduce, or a proof-of-concept if available.
- The contract(s) and deployment(s) affected (see
deployments/above).
- If you'd like to encrypt your report, request a PGP key from the contact above before sending sensitive details.
| Stage | Target Timeline |
|---|---|
| Initial acknowledgment of report | Within 48 hours |
| Preliminary assessment / severity triage | Within 5 business days |
| Fix or mitigation plan communicated to reporter | Within 30 days (severity-dependent) |
| Public disclosure (coordinated with reporter) | After a fix is deployed, or by mutual agreement |
We ask researchers to give us reasonable time to investigate and remediate an issue before any public disclosure.
- Vulnerabilities in third-party dependencies not modified by this repository (report these upstream).
- Contracts explicitly marked as deprecated or unused test scaffolding, unless they remain deployed with real funds.
- Issues requiring access to compromised maintainer credentials or infrastructure outside these contracts.
We appreciate responsible disclosure. Recognition or reward details, if any, will be confirmed by a maintainer.