Security

Reporting a vulnerability

If you have found a security problem in Predictifi, we want to hear about it privately first. This page explains how to report it, what is in scope, and how we treat good-faith research.

Review status

Predictifi uses open-source smart contracts covered by an in-repo Foundry test suite (unit, fuzz and stateful-invariant). They have not been reviewed by an external security firm.

This is a test deployment on Base Sepolia. The collateral is test USDC, which has no monetary value.

How to report

A private reporting address has not been published yet. Until one is listed here, please do not disclose the details publicly or in a public issue tracker.

A useful report includes:

the component affected (contract, page, API route, indexer or keeper);
step-by-step instructions to reproduce it;
any contract addresses, transaction hashes or request details involved, using your own wallets;
what an attacker could achieve, as you understand it.

Please give us a reasonable amount of time to look into a report before you share it with anyone else. We read every report, but we cannot promise a response time.

Scope

Smart contracts. The Predictifi contracts deployed on Base Sepolia (market maker, resolver, leverage, conditional orders and the vaults).
Web app. This website, its API routes, wallet sign-in (SIWE) and the operations console.
Indexer. The read model that serves market, position and leaderboard data to the site.
Keeper. The automation bot that submits transactions to the contracts on the protocol's behalf.

Out of scope

Third-party software and services: wallets, RPC providers, Base Sepolia itself and the test USDC token contract.
Denial-of-service or volumetric testing, spam, and automated scanning that generates heavy traffic.
Social engineering, phishing or physical attacks against people or infrastructure.
Limitations the site already documents on the platform status page.

Known limitations of the current deployment are listed on the platform status page. They do not need to be reported again.

Safe harbour

We will not take legal action against, or ask anyone to take action against, people who research and report a vulnerability in good faith and within this policy. Good faith means you:

test only with your own wallets, positions and accounts;
do not access, change or delete other people’s data or positions beyond the minimum needed to show the problem;
do not degrade the service for other people;
stop and report as soon as you have confirmed the issue;
keep the details private until we have had a reasonable chance to address them.

This covers our own systems only. It cannot give permission on behalf of third parties, such as wallet or RPC providers.

Rewards

There is no bug bounty program. We do not offer payment or other rewards for reports.

Machine-readable policy

This policy is also published as /.well-known/security.txt (RFC 9116).