Uxd Protocol Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: false
policy:
  - https://docs.uxd.fi/uxdprotocol/resources/bug-bounty
contact:
  - uxdlegal@gmail.com
program: self-run bug bounty (not hosted on HackerOne/Bugcrowd/Immunefi)
scope: >-
  Smart contract vulnerabilities in the UXD Solana program, tiered
  Critical/High/Medium/Low; proof-of-concept against privately deployed
  mainnet contracts required. Excludes self-exploited attacks, publicly
  deployed exploits, leaked-credential attacks, governance/admin privilege
  exploits, oracle data issues, liquidity issues, off-chain bot errors,
  best-practice suggestions, and Sybil attacks.
reward: 2% of UXP token supply allocated from the Community Fund; amounts and
  denomination subject to change.
evidence:
  - source: https://docs.uxd.fi/uxdprotocol/resources/bug-bounty
    kind: docs-bug-bounty-page
    keywords: [bug bounty, severity, proof of concept]
audits:
  page: https://docs.uxd.fi/uxdprotocol/resources/audits
  reviews:
    - {firm: Bramah Systems, date: '2022-01-14', subject: UXD Protocol, report: 'https://bramah.systems/audits/UXD_Audit_Bramah.pdf'}
    - {firm: Sec3, date: '2022-03-31', subject: UXD Protocol}
    - {firm: Sec3, date: '2022-06-24', subject: UXD Protocol}
    - {firm: Sec3, date: '2023-06-25', subject: UXD Protocol}
    - {firm: Dedaub, subject: UXD on Optimism}
    - {firm: Sherlock, subject: UXD on Optimism and Arbitrum}
notes: No /.well-known/security.txt exists (uxd.fi serves an SPA catch-all for
  every path). Six third-party security audits are published on the audits page.