Fixes are applied to main first. If you are running a fork or a pinned commit, please still report — we will coordinate disclosure with you.

Please do not open a public GitHub Issue for security vulnerabilities. Public disclosure before a fix is available puts all users at risk.

Follow this process instead:

1. Report privately using one of the contact methods below.
2. We acknowledge your report within 48 hours.
3. We triage and assign a severity within 7 days and share our assessment with you.
4. We ship a patch within 30 days for critical issues (see the SLA table for other severities).
5. We agree a coordinated disclosure date with you, typically after the fix is released.
6. You are credited in the Hall of Fame and release notes unless you prefer to remain anonymous.

If you receive no acknowledgement within 48 hours, please follow up via the other channel.

When reporting, please include:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept (PoC)
• Affected component(s) — contract name, function, file path, commit hash
• Any suggested mitigation or patch (optional but appreciated)

For sensitive details (working exploits, private data), encrypt your report:

• Preferred: use a GitHub Private Advisory — its content is visible only to maintainers and you.

• PGP email: request the current PGP public key by emailing security@votechain.dev with the subject PGP key request (no vulnerability details). Confirm the fingerprint with a maintainer through a second channel (for example a GitHub Private Advisory) before use, then encrypt:

  gpg --import votechain-security.asc
  gpg --encrypt --armor --recipient security@votechain.dev report.md

  Attach report.md.asc to your email. Never send private keys or seed phrases, even encrypted.

When a vulnerability is confirmed or an exploit is observed on a live deployment:

1. Contain — the admin calls pause on affected contracts to halt proposal creation and voting.
2. Assess — identify affected deployments, proposals and funds; preserve on-chain evidence (transaction hashes, events).
3. Remediate — develop and review the fix privately (GitHub Security Advisory fork); add regression tests.
4. Recover — deploy the fix via the upgrade procedure, then unpause.
5. Communicate — publish a GitHub Security Advisory and CHANGELOG entry; notify integrators.
6. Review — publish a post-mortem within 14 days of resolution.

• contracts/governance/** — proposal creation, voting, finalisation, execution, cancellation
• contracts/token/** — governance token minting, balances, transfers
• Contract logic errors: state transitions, quorum/tally calculation, access control, delegation
• Build and CI tooling that could affect contract correctness (scripts/, .github/workflows/)
• frontend/, backend/ and indexer/ code in this repository

• Third-party dependencies and upstream toolchains (Rust, Soroban SDK, Stellar Core) — please report those to the respective upstream projects
• Social engineering, phishing, or physical attacks
• Denial-of-service attacks that rely on unrealistic network-level assumptions outside the Soroban execution model
• Issues in forks or unofficial deployments not maintained by this repository

This project does not currently operate a paid bug bounty program.

We recognise and publicly credit all valid security reports in release notes. If a bounty program is introduced in the future, this document will be updated with program rules, payout ranges, and a link to the bounty platform.

We thank the following people for responsibly disclosing security issues:

Reporters are added here (with their permission) once the fix is released.

Key security properties of the contracts:

• cast_vote calls require_auth() — votes cannot be forged by a third party
• Double-vote prevention via a persistent HasVoted(proposal_id, voter) storage key
• Vote weight equals the voter's token balance at the time of the vote — no snapshot manipulation
• Only the designated admin address can execute or cancel proposals
• Quorum is enforced at finalisation — proposals cannot pass silently with low turnout
• All token amounts use i128 — no floating-point arithmetic or rounding errors

Date: 2026-04-29
Reviewer: automated + manual
Finding: ✅ No sensitive information leakage detected

• A3 – Sensitive Data Exposure: No private keys, seeds, internal counters, or raw storage indices are emitted. All emitted values are either public governance state or addresses that are inherently visible on-chain.
• A6 – Security Misconfiguration: Topic symbols use short 7-character identifiers — no disambiguation ambiguity between event types.
• Data minimisation: Each event carries only data required for off-chain indexers to reconstruct governance state. No redundant fields are present.

All emitted events satisfy the principle of minimal disclosure. No remediation required.