# Vaultfire V3 — Security Policy & Bug Bounty (Draft)

**Status: DRAFT. Not enable-live until multisig ratifies.**

## Reporting
- Email: security@vaultfire.xyz (rotate to a dedicated managed inbox before enable).
- GPG key: (to be published).
- Response SLA: acknowledgement within 24h, initial triage within 3 business days.

## Scope
Contracts in `v3-src/contracts/**` deployed on Base under the pilot cap.
V2 contracts are explicitly out of scope until the pilot expands.

## Severity ladder (per Immunefi + our overrides)
| Severity | Description | Payout band (USD) |
|---|---|---|
| Critical | Loss of principal, invariant #1 or #6 broken, admin takeover | 10k–50k |
| High | Locking of funds, forced signature verification bypass, reward theft | 3k–10k |
| Medium | Griefing, DoS with cost | 500–2000 |
| Low | Info leak, missing event, non-critical rounding drift | 200–500 |

Payout in USDC on Base from `MultisigGovernanceV3`-controlled treasury.

## Rules
- No mainnet PoC on user funds; use `feat/vaultfire-v3-safe-migration` fork.
- Responsible disclosure required; no public writeup until fix ships.
- Duplicate reports paid to earliest verifiable submitter.
- Findings that break any of the 15 protocol invariants or the ERC-4626
  property suite are eligible even when the current local tests pass.

## Out of bounds
- Social engineering, phishing.
- Reports about V2 (out of scope; V2 is immutable).
- Frontend-only reports without on-chain impact.
- Denial-of-service via RPC rate limits.

## Coordination
- Reporter agrees to a 30-day disclosure window from the first fix commit.
- We publish CVE-style advisories after fix + timelock elapse.
