> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usmewe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bug Bounty Program

> Earn rewards for finding security vulnerabilities

# Bug Bounty Program

Help secure usmewe and earn rewards for finding vulnerabilities.

## Program Overview

<Note>
  Our bug bounty program launches with mainnet. Currently in preview mode for testnet findings.
</Note>

| Severity     | Reward Range      | Response Time |
| ------------ | ----------------- | ------------- |
| **Critical** | $10,000 - $50,000 | 24 hours      |
| **High**     | $5,000 - $10,000  | 48 hours      |
| **Medium**   | $1,000 - $5,000   | 1 week        |
| **Low**      | $100 - $1,000     | 2 weeks       |

## Scope

### In Scope

<CardGroup cols={2}>
  <Card title="Smart Contracts" icon="file-contract">
    * TrustVault.sol
    * P2PLoan.sol
    * SocialVault.sol
    * InsurancePool.sol
    * Governance.sol
  </Card>

  <Card title="Web Application" icon="globe">
    * Authentication bypass
    * Authorization flaws
    * Injection vulnerabilities
    * Session management
  </Card>

  <Card title="API" icon="server">
    * Authentication/authorization
    * Rate limiting bypass
    * Data exposure
    * Business logic flaws
  </Card>

  <Card title="Mobile App" icon="mobile">
    * Local data security
    * Network security
    * Authentication issues
    * Key management
  </Card>
</CardGroup>

### Out of Scope

* Social engineering attacks
* Physical security issues
* Denial of service (DoS)
* Issues in third-party dependencies (report upstream)
* Issues already reported
* Testnet-only issues without mainnet impact

## Severity Guidelines

### Critical

<Warning>
  Direct loss of user funds or complete protocol compromise
</Warning>

Examples:

* Unauthorized withdrawal of funds
* Manipulation of Trust Score for unlimited borrowing
* Complete bypass of timelock/multi-sig
* Minting of tmUSDC without deposits

### High

Examples:

* Partial fund loss or significant manipulation
* Bypass of core security mechanisms
* Privilege escalation to admin roles
* Breaking invariants in financial calculations

### Medium

Examples:

* Limited fund manipulation
* Information disclosure of sensitive data
* Bypass of non-critical security features
* Logic errors with moderate impact

### Low

Examples:

* Minor information disclosure
* Issues requiring unlikely conditions
* UI/UX security improvements
* Best practice violations

## How to Report

### Step 1: Document

Prepare a detailed report including:

```markdown theme={null}
## Summary
Brief description of the vulnerability

## Severity Assessment
Your assessment of severity and impact

## Steps to Reproduce
1. Step one
2. Step two
3. ...

## Proof of Concept
Code, screenshots, or video demonstrating the issue

## Impact
What an attacker could achieve

## Suggested Fix
Your recommendation (optional but appreciated)
```

### Step 2: Submit

Send your report to: **[security@usmewe.com](mailto:security@usmewe.com)**

* Use PGP encryption if possible (key below)
* Include "Bug Bounty" in subject line
* One vulnerability per report

### Step 3: Wait

* You'll receive acknowledgment within 24 hours
* We'll assess and respond per severity timeline
* Keep vulnerability confidential during assessment

## PGP Key

```
-----BEGIN PGP PUBLIC KEY BLOCK-----
[PGP key will be published here]
-----END PGP PUBLIC KEY BLOCK-----
```

## Rules

<AccordionGroup>
  <Accordion title="Do" icon="check">
    * Test on testnet when possible
    * Stop testing if you access user data
    * Report promptly after discovery
    * Provide detailed reproduction steps
    * Allow reasonable time for fixes
  </Accordion>

  <Accordion title="Don't" icon="xmark">
    * Access or modify other users' data
    * Perform denial of service attacks
    * Social engineer team members
    * Disclose before we've fixed the issue
    * Demand payment before providing details
  </Accordion>
</AccordionGroup>

## Rewards

### Payment

* Paid in USDC (or fiat equivalent)
* Within 30 days of confirmed fix
* Bonus for exceptional reports

### Recognition

* Hall of Fame listing (with permission)
* Security researcher badge in app
* Invitation to private security updates

## Hall of Fame

<Info>
  Be the first to join our Security Hall of Fame!
</Info>

| Researcher | Findings | Total Rewards |
| ---------- | -------- | ------------- |
| -          | -        | -             |

## Legal Safe Harbor

We will not pursue legal action against researchers who:

* Act in good faith
* Follow responsible disclosure
* Avoid privacy violations
* Do not disrupt services
* Comply with applicable laws

## FAQ

<AccordionGroup>
  <Accordion title="Can I test on mainnet?">
    Yes, but use only your own accounts. Never access other users' data.
  </Accordion>

  <Accordion title="What if I accidentally access user data?">
    Stop immediately, do not store/share the data, and report the vulnerability.
  </Accordion>

  <Accordion title="How are rewards determined?">
    Based on severity, impact, and quality of report. We may adjust within ranges.
  </Accordion>

  <Accordion title="Can I disclose after it's fixed?">
    Yes, after 90 days or with our written permission, whichever is sooner.
  </Accordion>
</AccordionGroup>

## Contact

* **Email**: [security@usmewe.com](mailto:security@usmewe.com)
* **Response**: 24-48 hours
* **PGP**: Available above

<Card title="Security Overview" icon="shield" href="/security/overview">
  Learn about our security practices
</Card>