Report a vulnerability
Security vulnerabilities can be reported to:security@rugfreepump.com
Please provide enough technical information for the issue to be understood and, where possible, reproduced.
Scope
Security reports may concern vulnerabilities affecting RugFreePump-controlled components, including:- The RugFreePump on-chain program
- Bonding-curve calculations and accounting
- SOL and token handling
- Protocol authority and permission enforcement
- Sale lifecycle and state transitions
- Withdrawals
- Liquidity migration
- Token claiming
- Recovery and cancellation operations
- SOL/USD oracle integration
- RugFreePump website and dApp
- Backend and API services
- Blockchain indexing and data services
- WebSocket and real-time infrastructure
- Platform authentication and authorization
- Supporting RugFreePump infrastructure
Third-party systems
RugFreePump depends on external systems and protocols, including Solana, Pyth, Raydium, wallet providers, RPC providers, and other third-party infrastructure. Vulnerabilities originating entirely within a third-party system should generally be reported to the respective provider. However, vulnerabilities in RugFreePump’s implementation or integration of an external system are within the scope of this disclosure process.What to include
Where applicable, include:- A clear description of the vulnerability
- The affected component or functionality
- Steps required to reproduce the issue
- Expected behavior
- Actual behavior
- Potential security impact
- Relevant transaction signatures
- Relevant public blockchain addresses
- Proof-of-concept code or demonstrations
- Any other technical information that may help with investigation
Security impact
When reporting a vulnerability, describe what an attacker could potentially accomplish. Examples of security impact include:- Unauthorized movement of SOL or tokens
- Unauthorized access to privileged protocol functionality
- Bypassing protocol authority or permission checks
- Manipulation of bonding-curve accounting or calculations
- Bypassing purchase, withdrawal, or lifecycle restrictions
- Unauthorized token claims or bypassing token unlock restrictions
- Unauthorized changes to protocol state
- Incorrect or unauthorized liquidity migration
- Permanent or temporary loss of access to funds
- Compromise of user transaction or wallet interactions
- Unauthorized access to sensitive platform information
- Compromise of RugFreePump-controlled infrastructure
Responsible testing
Security testing should be limited to systems, accounts, wallets, assets, and environments that you are authorized to use. Security researchers should use local testing environments or the RugFreePump public Devnet deployment for vulnerability research and proof-of-concept demonstrations whenever possible. Active security testing, vulnerability exploitation, or proof-of-concept execution against the RugFreePump production Mainnet on-chain program or production infrastructure is prohibited without prior written authorization from the RugFreePump security team. Testing on the public Devnet deployment must not interfere with other users, accounts, assets, or shared infrastructure. Potentially destructive testing requires prior written authorization, including on Devnet. Read-only inspection of publicly available Mainnet and Devnet transactions, account states, and on-chain program information is permitted. Please avoid actions that could cause unnecessary harm, financial loss, or disruption. Do not:- Access or attempt to access another person’s wallet or private credentials
- Steal, transfer, or retain assets that do not belong to you
- Obtain, expose, or publish private keys, seed phrases, passwords, or credentials
- Modify or destroy unrelated data
- Disrupt platform availability or other users
- Conduct denial-of-service attacks
- Conduct large-scale automated testing that could disrupt production systems
- Social-engineer users or RugFreePump personnel
- Attack third-party systems or services
- Publicly disclose sensitive information obtained during testing
security@rugfreepump.com before attempting further testing.
Public disclosure
Please allow RugFreePump a reasonable opportunity to investigate a reported vulnerability before publicly disclosing technical details. Do not publish exploit code, private report contents, or other information that could enable exploitation while the vulnerability remains unresolved. If you believe a vulnerability is actively being exploited or presents an immediate risk to users, clearly identify this in the report and provide any available evidence. RugFreePump may coordinate public disclosure with the reporter when appropriate.Bug bounty
RugFreePump does not currently operate a formal bug bounty program. Submitting a vulnerability report does not create an entitlement to monetary compensation or any other reward. Any future vulnerability-reward program will be announced separately if introduced.Report handling
Reports submitted tosecurity@rugfreepump.com are reviewed by the RugFreePump team.
Investigation and remediation may depend on factors including:
- Severity and potential impact
- Reproducibility
- Affected component
- Whether the issue affects production systems
- Whether exploitation is occurring
- Complexity of remediation