Trust Token · Vulnerability Disclosure

Trust Token Vulnerability Disclosure

Vulnerability disclosure

Trust Token publishes a vulnerability disclosure policy for reporting security issues. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

CompanyStablecoinsDeFiBlockchainTokenizationLendingCryptocurrencyFinTech
Program: security.txt present

Disclosure Policy

Policy
https://github.com/trusttoken/stablecoins-bug-bounty
Policy
https://github.com/trusttoken/bug-bounty
Policy
https://immunefi.com/bounty/truefi/

Security Contact

Contact
security@archblock.com
Contact
security@trusttoken.com

Source

Vulnerability Disclosure

trust-token-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-07-21'
method: searched
probe: true
notes: TrustToken (now Archblock) publishes two bug bounty programs through its
  GitHub organization. The active Archblock (Poland) Stablecoins Bug Bounty covers
  the 1GBP and 1USD stablecoin smart contracts plus all *.archblock.com websites,
  with awards from 100 USD up to 100,000 USD (capped at 10% of funds directly
  affected). The earlier TrueFi smart-contract bounty was previously hosted on
  Immunefi (currently paused there) with terms maintained in the trusttoken/bug-bounty
  repo. No /.well-known/security.txt is published on archblock.com or
  app.archblock.com (probed 404).
policy:
- https://github.com/trusttoken/stablecoins-bug-bounty
- https://github.com/trusttoken/bug-bounty
- https://immunefi.com/bounty/truefi/
contact:
- security@archblock.com
- security@trusttoken.com
bounty:
  active: true
  programs:
  - name: Archblock (Poland) Stablecoins Bug Bounty
    url: https://github.com/trusttoken/stablecoins-bug-bounty
    scope:
    - '1GBP smart contract eth:0x86B4dBE5D203e634a12364C0e428fa242A3FbA98'
    - '1USD smart contract eth:0x403b0a511AC03851496Eb83a2A0fb5204dcDB241'
    - '*.archblock.com websites'
    rewards: 100-100,000 USD by severity (smart contracts), 100-30,000 USD (websites)
    contact: security@archblock.com
  - name: TrueFi Smart Contract Bug Bounty
    url: https://github.com/trusttoken/bug-bounty
    status: Immunefi listing paused; GitHub terms cover other contracts
    rewards: 100-100,000 USD by CVSS 3.0 severity and capital-loss potential
    contact: security@trusttoken.com
evidence:
- source: https://github.com/trusttoken/stablecoins-bug-bounty
  kind: bug-bounty-repo
  detail: README names security@archblock.com, in-scope assets, and award ranges (pushed 2025-03-03)
- source: https://github.com/trusttoken/bug-bounty
  kind: bug-bounty-repo
  detail: TrueFi bug bounty terms, security@trusttoken.com disclosure contact
- source: https://www.archblock.com/.well-known/security.txt
  kind: security.txt
  detail: HTTP 404 - not published