Trust
Security & bug bounty
Responsible disclosure keeps the network honest. We pay for it.
We run a continuous bug-bounty program covering the settlement contracts, the Fabric scheduler, the node client, and the SDK. Report a vulnerability privately and we’ll respond within 48 hours.
Report a vulnerability
Email — with a description, impact assessment, and reproduction steps. Encrypt sensitive details with our PGP key (fingerprint published in the repo). Please do not open public issues for security reports.
Scope
- Settlement & reward contracts on Robinhood Chain
- Fabric scheduler and execution receipts
- Node client and runtime (sandbox escapes, job tampering)
- SDK, CLI, and API authentication
Out of scope
- Public-RPC rate limiting and third-party explorer behavior
- Social engineering and physical attacks
- Reports from automated scanners without a working proof-of-concept
Reward tiers
SeverityExampleReward
CriticalLoss of funds, settlement forgery, RCE on a node$10,000 – $50,000
HighAuth bypass, reward inflation, key exfiltration$3,000 – $10,000
MediumMetering errors, scoped-key escalation$750 – $3,000
LowInformation disclosure, denial-of-service vectors$150 – $750
Rewards paid in USDC or $XOLED. Final severity and payout are at the team’s discretion.