Bug Bounty Program
Help secure usmewe and earn rewards for finding vulnerabilities.Program Overview
Our bug bounty program launches with mainnet. Currently in preview mode for testnet findings.
Scope
In Scope
Smart Contracts
- TrustVault.sol
- P2PLoan.sol
- SocialVault.sol
- InsurancePool.sol
- Governance.sol
Web Application
- Authentication bypass
- Authorization flaws
- Injection vulnerabilities
- Session management
API
- Authentication/authorization
- Rate limiting bypass
- Data exposure
- Business logic flaws
Mobile App
- Local data security
- Network security
- Authentication issues
- Key management
Out of Scope
- Social engineering attacks
- Physical security issues
- Denial of service (DoS)
- Issues in third-party dependencies (report upstream)
- Issues already reported
- Testnet-only issues without mainnet impact
Severity Guidelines
Critical
Examples:- Unauthorized withdrawal of funds
- Manipulation of Trust Score for unlimited borrowing
- Complete bypass of timelock/multi-sig
- Minting of tmUSDC without deposits
High
Examples:- Partial fund loss or significant manipulation
- Bypass of core security mechanisms
- Privilege escalation to admin roles
- Breaking invariants in financial calculations
Medium
Examples:- Limited fund manipulation
- Information disclosure of sensitive data
- Bypass of non-critical security features
- Logic errors with moderate impact
Low
Examples:- Minor information disclosure
- Issues requiring unlikely conditions
- UI/UX security improvements
- Best practice violations
How to Report
Step 1: Document
Prepare a detailed report including:Step 2: Submit
Send your report to: security@usmewe.com- Use PGP encryption if possible (key below)
- Include “Bug Bounty” in subject line
- One vulnerability per report
Step 3: Wait
- You’ll receive acknowledgment within 24 hours
- We’ll assess and respond per severity timeline
- Keep vulnerability confidential during assessment
PGP Key
Rules
Do
Do
- Test on testnet when possible
- Stop testing if you access user data
- Report promptly after discovery
- Provide detailed reproduction steps
- Allow reasonable time for fixes
Don't
Don't
- Access or modify other users’ data
- Perform denial of service attacks
- Social engineer team members
- Disclose before we’ve fixed the issue
- Demand payment before providing details
Rewards
Payment
- Paid in USDC (or fiat equivalent)
- Within 30 days of confirmed fix
- Bonus for exceptional reports
Recognition
- Hall of Fame listing (with permission)
- Security researcher badge in app
- Invitation to private security updates
Hall of Fame
Be the first to join our Security Hall of Fame!
Legal Safe Harbor
We will not pursue legal action against researchers who:- Act in good faith
- Follow responsible disclosure
- Avoid privacy violations
- Do not disrupt services
- Comply with applicable laws
FAQ
Can I test on mainnet?
Can I test on mainnet?
Yes, but use only your own accounts. Never access other users’ data.
What if I accidentally access user data?
What if I accidentally access user data?
Stop immediately, do not store/share the data, and report the vulnerability.
How are rewards determined?
How are rewards determined?
Based on severity, impact, and quality of report. We may adjust within ranges.
Can I disclose after it's fixed?
Can I disclose after it's fixed?
Yes, after 90 days or with our written permission, whichever is sooner.
Contact
- Email: security@usmewe.com
- Response: 24-48 hours
- PGP: Available above
Security Overview
Learn about our security practices