SECURITY
Found a problem? Tell us privately.
How to report a security issue in the Lightdive contracts or this website, what is in scope, and what we have and have not checked.
The Lightdive v3 contracts have not been audited by an independent third party. Our own tests and tools are listed below; they are not an audit.
01
How to report
- Use GitHub's private report form on our public repository (Security → Report a vulnerability). Only the maintainers can read it.
- Say what is affected, how to reproduce it, and what an attacker could gain. A failing test is the most useful form.
- Test only on the testnet or your own local chain. Never attack mainnet contracts or other players, and do not post the issue publicly before it is fixed.
- We aim to answer within 7 days and agree a disclosure date with you.
02
In scope
The Lightdive v3 contracts on Robinhood Chain testnet, and on mainnet once deployed there.
Not in scope: ordinary website bugs (open a normal issue), wallets, RPC providers, drand itself, social engineering, and flooding.
03
Rewards
There is no fixed reward table. Valid reports are credited publicly (if you agree), and any reward is agreed with the reporter case by case once the issue is confirmed. This page is not a promise of payment.
04
What we check ourselves
- End-to-end contract tests on a local chain, including multi-wallet (Sybil) cases.
- Foundry fuzz and invariant tests: the pool always holds what it owes, payouts stay under the daily cap, and similar rules.
- Static analysis with Slither and Aderyn on every contract change; every finding is reviewed and recorded.
- Limits that cap damage: a 48-hour delay on every setting change, a guardian that can only pause (for at most 72 hours), and a daily payout cap of 5% of the pool.
No tool finding "nothing" proves the contracts are safe.
We never ask for private keys or recovery phrases, and we never contact you first by direct message.