Bug bounty and disclosure
How to report a vulnerability in the Tuo contracts or platform, and what the bug bounty will cover once it is live.
Tuo will run a public bug bounty after the independent external review closes. Until then, responsible disclosure is handled directly with the team.
Status
| Item | Status |
|---|---|
| Program | Planned on Immunefi, opening after the external review |
| Reward tiers | To be announced with the program |
| Interim contact | See below |
The disclosure address below is a placeholder. It must be confirmed and monitored before these docs are published.
Interim disclosure
Email security@tuo.app with the subject line Tuo security report. You will receive an
acknowledgement within two business days. Please do not open a public issue, post on social
media, or test against a live deployment holding customer funds.
Include in the report:
- The contract, network and address affected, or the platform component if off-chain.
- A description of the issue and the impact you believe it has.
- Steps to reproduce, ideally as a Foundry test against the public source.
- Any transaction hashes from a testnet or a fork.
- How you would like to be credited, if at all.
Scope
When the program opens, its scope will be the three deployed contracts on Arbitrum One:
| Contract | Role |
|---|---|
TuoVault | Custody, deposit, withdrawal, keeper surface, fee accounting |
TuoPositionNFT | The ERC-721 position token |
TuoSwapRouter | The vault-only aggregator execution wrapper |
The addresses will be listed on Deployed addresses once the deployment is live. Vendored Uniswap code, OpenZeppelin, the Uniswap V3 protocol itself, Hyperliquid and Circle's CCTP are out of scope; report issues in those to their own programs.
Reports that would qualify for the highest tiers:
- Any path that moves a position's funds to an address other than the NFT owner, the vault, the Uniswap position manager, or the position's bound Hyperliquid operator.
- Any way for a keeper to exceed the action or value-loss budgets, or to enrich itself.
- Any way to charge the performance fee on principal, or to change the fee percentage.
- Any way to block an owner's exit through
withdraworemergencyWithdraw. - Any way for a treasury holder to reach a deployed liquidity position or an idle balance.
Safe harbour
Tuo will not pursue legal action against researchers who act in good faith, follow this process, avoid privacy violations and service disruption, do not access or modify other users' data or funds, and give the team reasonable time to fix an issue before disclosing it. Testing must be done on a testnet, a local fork, or with the team's written agreement.
Known and accepted risks
Before reporting, read Audits and the Risks section. Several design decisions there are disclosed and accepted; a report that restates one of them without a new attack path will not qualify for a reward.