Responsible disclosure
Reporting a vulnerability
Write to team@quantillon.money before any public disclosure.
Programme status
Disclosure programme : ACTIVE
Quantillon currently operates an unpaid vulnerability disclosure programme. A funded bug bounty is planned but has not launched. Reports submitted under this policy are not eligible for payment unless a separate bounty programme explicitly says otherwise. With your agreement, valid reports may receive public credit.
Report
What to send
- The contract or contracts affected, with their addresses.
- A reproduction, preferably a Foundry test against a local fork.
- Your assessment of the impact and any conditions needed to reproduce it.
What happens next
We aim to acknowledge a report within 3 business days and provide an initial assessment within 10 business days. We will keep you informed while we validate and remediate it.
Please keep the issue confidential while we investigate and agree a reasonable disclosure date with you. Timing depends on severity and remediation complexity; we will not ask for indefinite secrecy.
Scope
In and out
In scope. Quantillon-written contracts under src/ as deployed on Base mainnet, including the oracle stack, external-vault integration logic, and the live addresses on the coverage page.
Third parties. A defect in third-party code is outside this programme, but an exploitable impact caused by how Quantillon configures or integrates that code is in scope.
Out of scope. Social engineering, unsupported claims without a security impact, and behaviour that merely exercises an already-authorized role within its documented powers. Other Quantillon infrastructure is not authorized for testing unless we confirm it in writing.
Machine-readable contact details: security.txt. The same policy appears in the protocol’s security guide.
Research rules
How to test safely
Permitted
- Review public source code, verified bytecode, ABIs, transaction history, and on-chain state.
- Reproduce suspected issues in Foundry tests, local forks, or environments you control.
- Use your own accounts and data while avoiding any effect on other users or protocol operations.
Not permitted
- Executing exploit or disruptive transactions on Base mainnet without prior written authorization.
- Accessing, changing, or moving data or funds that are not yours.
- Denial of service, abusive automated traffic, oracle or market manipulation, governance interference, phishing, or social engineering.
Commitments
What you can expect from us
Safe harbour for good-faith research
We will not pursue legal action against anyone who reports a vulnerability in good faith, follows this policy, avoids harming users or their funds, and gives us reasonable time to fix the issue before disclosing it.
Credit
With your agreement, we credit you by name or handle when the issue is published.
Our own findings
How review findings are published
The same principle applies to what our own reviews find: fix first, then publish.
- While a finding is open, nothing about it is public, including the number of open findings.
- Once its fix is deployed and 14 days have passed, the finding is listed under its review with its severity, a one-line summary, and the version and commit that resolved it.
- Totals by severity may accompany a review’s disclosed findings once every high-severity finding in it is resolved.
- Design choices that are accepted rather than fixed are written up as trust assumptions, in plain technical terms.
Full write-ups of resolved findings are the intended next step. One-line summaries come first.
Community
Security Contributors & Acknowledgments
We sincerely thank the independent security researchers and community members who have helped improve Quantillon Protocol through responsible vulnerability disclosure.
We maintain a public list of security contributors to recognize their valuable efforts.