Security bounty

How to report

• Write to the address below with the steps to reproduce the problem, what it affects, and the address you want to be paid at.
• Please report privately first. We do not take legal action against good-faith research that respects people's funds and data.
• The report and the fix, or the reason for not fixing it, are published in the reviews folder of the public repository once it is safe to do so.

security@burnticker.com

Read SECURITY.md

In scope

• The burn program: any way to move SOL or tokens other than buying the coin and burning it, to store a reading without the required signatures, or to change a rule, a reading or a receipt after the fact.
• The pair program: any way to move a pair's SOL or tokens other than by its formula to the recorded recipients, or a privileged signer after the pair is set up.
• The keeper and the site's code: signing something the program should refuse, a market quote reaching a rule, a void or unsettled market leading to a burn, or the audit or the receipt checker passing a receipt that does not match.
• The site's API: a request from another site changing anything, or a route leaking a value it says it never reads.
• The publishing scripts: a way to put a file in the public repository that the list of allowed files does not name.

Out of scope

• Raydium, Jupiter, Polymarket, Pyth, RedStone, Reclaim and Solana themselves. Please report to them, and tell us too.
• Denial of service against the keeper or the site, and social engineering.
• Findings that need a stolen operator key. The powers register already says what that key can do.
• How any coin trades.

The bounty wallet

This mainnet wallet is held by the operator and is separate from the Squads vault. Each payment is a plain transfer from the bounty wallet to the address the reporter names, and its transaction is posted in the report's thread.