Trust & safety
Bug bounty
There is no funded reward programme yet. The disclosure channel is live and reports are treated seriously.
- Version
- 1.0
- Effective
- 2026-09-06
- Last updated
- 2026-09-06
In scope
- Protocol contracts deployed on Arc Testnet, as listed on the contracts page.
- Fee accounting, liquidity accounting and redemption logic.
- The bonded resolution adapter, including bond and challenge-window handling.
- The web interface, including transaction construction and approval flows.
Out of scope
- Issues in Arc itself, in the USDC contract, or in third-party wallets and RPC providers.
- Findings that require a compromised user device or leaked private key.
- Automated scanner output without a demonstrated impact.
- Best-practice suggestions with no security consequence.
Rules
- Never touch funds or positions belonging to other users.
- Never attack live infrastructure with denial-of-service.
- Report privately first and allow a reasonable fix window.
Rewards
No monetary reward is offered at this time. Reward tiers will be published here if and when a funded programme exists.
#rewardsHow to report
Email [SECURITY_EMAIL] with reproduction steps, affected addresses and impact. PGP details will be published here once available.
#how