Skip to content

SECURITY.md

Latest commit

 

History

History
57 lines (38 loc) · 2.52 KB

SECURITY.md

File metadata and controls

57 lines (38 loc) · 2.52 KB
Raw

Security Policy

Supported Versions

We recommend always running the latest deployed version of OneSIP. Smart contracts are versioned by their published Move package ID.

Version Supported
2.0.x (current) ✅ Active support
< 2.0 ❌ Not supported

Reporting a Vulnerability

If you discover a security vulnerability in OneSIP — whether in the Move smart contracts (contracts/sources/), the off-chain API layer (app/api/), or the frontend — please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities. Instead, report privately via a GitHub Security Advisory or by contacting the maintainer directly through GitHub.

What to include

  • Type of vulnerability (e.g. reentrancy-equivalent state race, access-control bypass, integer overflow)
  • Affected module/file and function name
  • Steps to reproduce, ideally with a Move test case or API request
  • Potential impact (funds at risk, unauthorized access, etc.)
  • Your contact information for follow-up

What to expect

  1. Acknowledgment within 48 hours
  2. Triage & severity assessment
  3. Fix development and testing (including a regression test in contracts/sources/ where applicable)
  4. Coordinated disclosure — we will not publicly disclose details until a fix is deployed
  5. Credit to the reporter (if desired) in the release notes

Scope

In scope:

  • Move contracts: contracts/sources/sip_manager.move, yield_router.move, lock_vault.move
  • Off-chain API routes: app/api/**
  • Frontend wallet-signing flows: components/, hooks/, lib/
  • Deployment configuration: Dockerfile, docker-compose.yml, nginx.conf, netlify.toml

Out of scope:

  • Vulnerabilities in upstream dependencies (report to the OneChain / Sui / Next.js maintainers directly)
  • Denial-of-service reports without a reproducible exploit
  • Social engineering or phishing attacks targeting users
  • Issues that require a compromised wallet private key as a precondition

Known Design Constraints

  • Emergency vault unlock requires a minimum 7-day (MIN_LOCK_DURATION) time-lock, enforced on-chain — this is a deliberate design trade-off between fund availability and theft resistance, not a bug.
  • Multi-sig emergency unlock requires 3-of-5 (REQUIRED_APPROVALS) independent guardian approvals — guardian key management is currently the responsibility of the vault owner.

Thanks

Thank you for helping keep OneSIP and its users safe. 🙇