> For the complete documentation index, see [llms.txt](https://novacont.gitbook.io/nova-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://novacont.gitbook.io/nova-docs/audit-and-security/bug-bounty-and-responsible-disclosure.md).

# Bug Bounty & Responsible Disclosure

### What this program offers

NovaCont does not currently offer a monetary or material bug bounty.

Verified reports are credited in the Hall of Fame, with the researcher's permission, regardless of severity. We treat this as recognition rather than compensation, and we would rather say so plainly than advertise a reward we can't fund at a level that matches the work.

A funded program is planned and will be paid from protocol fees. When it exists, the amounts will be published on this page. Until then, please read the paragraph above as the complete offer, not as an opening position.

None of this changes how reports are handled. Every finding is triaged, fixed, and documented on the same terms whether or not there is money attached.

### Program Scope

| Contract          | Network | In Scope? |
| ----------------- | ------- | --------- |
| NovaCont.sol      | Base    | Yes       |
| NovaJury.sol      | Base    | No        |
| NovaContLite.tact | TON     | Yes       |

Confirm you are looking at the address above and at the current deployed version before reporting. Version and source details are in each repository's `SECURITY.md`.

**Out of scope:**

* Frontend and UI issues, including the Telegram Mini App and the web dApp. Neither holds user funds; the contracts are the security boundary. Report these to <support@novatechnology.app> as regular bugs, unless you can demonstrate an on-chain effect.
* Third-party infrastructure: Base and TON themselves, Chainlink, TonConnect, Telegram, wallet applications, public RPC endpoints.
* Social engineering against users or the team.
* Denial of service requiring unrealistic resources or gas expenditure.
* Findings from a static analysis tool with no demonstrated exploitability, particularly gas-optimization and API-preference classes already documented in our own published scans.
* Known, accepted design tradeoffs. These are listed per contract in the repository `SECURITY.md` files, most notably the centralization of dispute resolution.

### Severity

Severity determines triage priority and how a finding is documented, not a payout. Full per-contract definitions are in the repository `SECURITY.md` files; in summary:

| Severity | What it covers                                                                                                            |
| -------- | ------------------------------------------------------------------------------------------------------------------------- |
| Critical | Any path to unauthorized withdrawal of locked funds, or to distributing more than an agreement locked                     |
| High     | Funds reachable but permanently stuck, out-of-order state transitions, bypassing a timeout or an authorization check      |
| Medium   | Denial of service against a specific agreement or handler, incorrect fee or split calculation, resolver assignment errors |
| Low      | Gas inefficiency, missing or misleading events, documentation errors with no on-chain impact                              |

### How to report

**Do not disclose a finding on a public channel: X, Discord, GitHub Issues, or anywhere else, before it has been reviewed and addressed.**

Send the report to [**security@novatechnology.app**](mailto:security@novatechnology.app) and include:

* The affected contract, address, and function or message handler
* Step-by-step reproduction, or a proof of concept
* The potential impact, and whether user funds are at risk
* A suggested mitigation, if you have one

What happens next:

| Stage           | Target                                     |
| --------------- | ------------------------------------------ |
| Acknowledgement | Within 48 hours                            |
| Initial triage  | Within 7 days                              |
| Status updates  | As needed while remediation is in progress |

Because deployed contracts are immutable on both Base and TON, remediating a confirmed issue may mean deploying a new version and migrating rather than patching in place. That takes longer than a server fix, and we will be explicit about the plan and the timeline once a finding is confirmed.

Details stay confidential until a fix is shipped. After that, the finding may be published with the researcher's permission, including in the Hall of Fame.

### Safe harbor

We won't pursue legal action against researchers acting in good faith:

* Avoid violating user privacy
* Don't exploit a vulnerability beyond what is needed to demonstrate impact
* Don't intentionally disrupt the contracts or the applications
* Follow this disclosure policy

### Strictly prohibited

Testing that violates these rules falls outside the disclosure process and may create legal liability:

* Live attacks against real user funds on mainnet. Proofs of concept belong on testnet, or on both sides of an agreement you funded yourself
* Live testing that could deny service to real users
* Social engineering or phishing against real users or the team

### Hall of Fame

Verified reporters are listed here, with permission, as reports are resolved.

*List will be updated as reports are resolved.*