This policy covers the ledgerlens-score Soroban smart contract and the surrounding deployment tooling in this repository.
Out-of-scope:
- The off-chain detection pipeline (
core,datarepos) - The public API server (
apirepo) - The web dashboard (
dashboardrepo)
| Contract version | Status |
|---|---|
| 1.x (testnet) | Active |
| 0.x (pre-release) | Not supported |
Please do not open a public GitHub issue for security vulnerabilities.
Report security issues by emailing security@ledgerlens.io with the subject line:
[SECURITY] <short description>
Include:
- A clear description of the vulnerability and the affected contract function(s).
- Steps to reproduce or a proof-of-concept (PoC) — even a pseudocode sketch helps.
- The potential impact (e.g. unauthorized score submission, admin key extraction, fund loss if integrated with an AMM).
- Your contact details if you would like to be credited.
| Milestone | Target |
|---|---|
| Acknowledgement | Within 48 hours |
| Triage and severity rating | Within 7 days |
| Fix or mitigation in testnet | Within 21 days |
| Public disclosure | After fix ships |
We follow Responsible Disclosure. We will not take legal action against researchers who follow this policy.
| Attack vector | Mitigation |
|---|---|
| Unauthorized score write | submit_score requires service.require_auth() |
| Compromised service key | pause() halts submissions; set_service() rotates the key |
| Accidental admin key loss | Two-step transfer: new admin must call accept_admin() |
| Score poisoning via out-of-range data | score and confidence clamped to 0-100 on-chain |
| DoS via unbounded storage | History ring buffer capped at HISTORY_MAX_DEPTH (10) per pair |
| Large batch denial of service | Batch size capped at MAX_BATCH_SIZE (20) per invocation |
There is currently no formal bug bounty program. Outstanding security reports will be credited in the release notes and can be listed in your portfolio with our written consent.
When a vulnerability is confirmed and a fix is ready, we will:
- Deploy the patched contract to testnet.
- Notify downstream teams (
api,dashboard) with the newCONTRACT_ID. - Publish a post-mortem in the GitHub Releases section.
- Credit the reporter (unless they prefer to remain anonymous).