Security
If you find a vulnerability in the realize Protocol, please tell us privately first. We read every report.
Report a vulnerability
Email protocol@realize.fun with "Security report" in the subject. English or Portuguese are both fine.
Please include what you found, the instruction or account involved, how to reproduce it, and the impact you expect. A proof of concept on a local validator or on devnet helps a lot.
Do not post details in public. If you need to check that your email arrived, send a message to @LaunchOnRLZ on X without the details.
Scope
- The realize Protocol program on Solana:
5BEMuVyRY43q8ZnsTVJHqj6fGjXrGew4HCXbNwWXCoKJ. It is not deployed on mainnet yet; this page will say when it is. - Its source code, release v1.0.0, will be public at github.com/realize-fun/realize-protocol when realize opens. Researchers can ask for access before then at protocol@realize.fun.
- The realize website and app are also welcome in reports.
- Pump.fun, PumpSwap and Jupiter Lock are programs run by other teams. Please report their issues to them.
While you research
- Test only on a local validator or on devnet. Never move, lock or put at risk anyone else's funds on mainnet.
- No denial of service, spam, social engineering or access to other people's data.
- Give us a reasonable time to fix the issue before you disclose it, normally 90 days or until a fix is live, whichever comes first.
What we do
- We confirm we received your report within 72 hours and keep you updated until it is resolved.
- We credit you publicly once it is fixed, if you want to be credited.
- We will not take legal action against research done in good faith under these rules.
Audits and rewards
An audit by a specialised external firm is planned. Its report will be linked here.
No bug bounty programme has been announced yet. If one starts, its terms will be published on this page.