RELICSLaunchpad

Security & responsible disclosure

RELICS Launchpad welcomes responsible disclosure of security issues. This page is the policy; the machine-readable contact record is at /.well-known/security.txt.

Contact status: not yet verified.The address below is the project’s final choice, but delivery to it has not been confirmed yet. If you do not receive an acknowledgement, the mailbox — not your report — is most likely at fault. Please do not treat silence as disinterest.

Reporting a vulnerability

Email security@relics.wtf. Please include:

  1. A clear description of the issue and its impact.
  2. Step-by-step reproduction — a proof of concept, transaction traces, or a failing test.
  3. The affected component, chain, and commit or deployed address.
  4. Your assessment of severity and any suggested remediation.

Please do not

  • Open a public issue for a suspected vulnerability.
  • Exploit a finding beyond what is needed to demonstrate it.
  • Access or modify data that is not yours.
  • Run denial-of-service tests against any deployment.

What to expect

  • An acknowledgement within a reasonable window, once the contact mailbox is verified.
  • Updates on remediation progress, and public-disclosure timing coordinated with you.
  • Credit for reporters who want it.

A formal bug-bounty program, its scope, and any rewards are not yet defined. This policy will be updated when they are. Please do not assume a reward is on offer.

Scope

In scope

  • This launchpad web application and its deployment.
  • The launchpad smart-contract source and its on-chain deployments.
  • The SDK, indexer, and governance / upgrade tooling.

Out of scope

  • The separate, pre-existing RELICS artwork site at www.relics.wtf — a distinct property, not part of this launchpad.
  • Third-party dependencies and infrastructure (Uniswap v4, Safe, RPC providers, Vercel, wallets). Report those to their maintainers; a heads-up here is still appreciated.
  • Findings that require a compromised end-user device, physical access, or social engineering of project staff.

Deployment status

The launchpad platform contracts are deployed and open to permissionless launches on Ethereum, Base, Robinhood Chain. The factory is 0x25003C3EBC2036CfE9E4037d4e7E6F840a06522E on each of them. Deployed contracts and the projects launched through them are in scope.

BNB Smart Chain is prepared but not deployed. There is nothing on that chain to report against yet.

Verifying the code yourself

Every deployed contract is source-verified on its chain's explorer. Verify the runtime bytecode yourself against the published source before relying on any description of it.

Findings are likely and welcome. Report what you can reproduce against a deployed address or a commit, and this page will tell you what to expect in return.