Responsible disclosure

If you find a vulnerability, report it privately. Do not open a public issue, and do not post about it before a fix is deployed.

What to include

• The affected contract and function.
• The impact — what an attacker gains, and what a user loses.
• A reproduction. A Foundry test is ideal:

function test_vulnerability() public {    // setup    // exploit    // assert the bad outcome}

• Any suggested fix.

You will receive an acknowledgement, an assessment, and a disclosure timeline.

In scope

Out of scope

• Pons V2 itself — report to Pons.
• Uniswap v4 core.
• Robinhood Chain infrastructure.
• RPC availability.
• Anything requiring a compromised admin multisig.
• Known limitations already documented in known limitations.

Properties worth attacking

The invariants are the most useful target. Break one and you have found something real:

1. totalSentToBuybacks + totalSentToStakers + totalSentToReserve == totalRevenueRouted
2. totalRewardsClaimed <= totalRewardsReceived, and staking always holds what it owes
3. PLOUTO.balanceOf(staking) >= totalStaked
4. totalRevenueClaimed - totalRevenueRouted == unallocatedRevenue
5. totalBudgetReceived - totalEthSpent == buybackBudget
6. totalPloutoBurned + totalPloutoSentToDead == totalPloutoRetiredByProtocol
7. The executor never retains PLOUTO between executions
8. A donation can never increase totalRevenueClaimed
9. A failed buyback leaves budget and balance untouched
10. The registered token can never change

What we ask

• Give a reasonable window to fix before publishing.
• Do not exploit against real user funds. Use a fork.
• Do not access, modify or destroy data belonging to others.

What we commit to

• Acknowledge promptly.
• Keep you informed.
• Credit you publicly if you want it.
• Not pursue legal action for good-faith research within these guidelines.