Report a bug
Found something broken? Tell us what happened and attach a screenshot. Every report is read by the team.
Bug bounty
We reward valid bug reports. Critical bugs earn higher rewards. The final amount depends on impact and report quality.
Severity
- CriticalLoss or theft of user funds, bypassing curve or treasury controls, taking over an account or admin session.
- HighReading another user's private data, forcing a trade or transfer a user did not approve, persistent XSS.
- MediumWrong balances, prices or fees shown to users, broken access checks without fund impact.
- LowReproducible functional bugs, misleading copy, layout bugs that block an action.
In scope
- arctis.fun web app and its /api/v1 endpoints
- ARCTIS on-chain programs and the treasury, burn and distribution flows
- Wallet, trading, launch, rewards and community features
Out of scope
- Third-party services: Privy, wallets, DEXs, RPC providers and explorers
- Tokens launched by users, their prices and their creators
- Denial of service, spam, social engineering and physical attacks
- Reports from automated scanners without a working proof of impact
Responsible disclosure
- Report security issues through this form and keep them private until we confirm a fix
- Only test with your own accounts and wallets. Never access other users' funds or data
- The first valid report of an issue is the one rewarded