Security

If you believe you have found a security vulnerability in Hadron, please report it to us privately. Do not open a public GitHub issue or disclose it publicly until we have shipped a fix.

How to report

Email founders@hadron.fi with a subject line starting with "Security:". Please include:

• The affected program, contract, service, or site
• A description of the issue and its impact
• Steps to reproduce, ideally with a proof of concept (a local validator or LiteSVM test is ideal)
• How you would like to be credited, if at all

Scope

On-chain programs deployed on Solana mainnet:

• Hadron core
  HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8
• Hadron fee split
  HADRoNRgAjwtXBh5MFfy8WePDR1vHsufYA4SXDYmj57c

Also in scope: the @hadron-fi SDKs, hadron.fi, and dashboard.hadron.fi.

Out of scope: third-party services such as aggregators, wallets, and RPC providers. Pool prices are set by each pool's operator by design, so a pool quoting badly because of its own operator's price feed or curve settings is not a protocol vulnerability.

Guidelines

• Test against a local validator, LiteSVM, or devnet. Do not run exploits against mainnet pools.
• Do not access, move, or freeze funds that are not yours.
• Do not degrade service for others (spam, denial of service) or use social engineering.
• Give us reasonable time to fix the issue before any public disclosure.

What you can expect from us

• An acknowledgement of your report within 7 business days
• Updates as we investigate and fix the issue
• Public credit once the fix ships, if you want it

Audits

The Hadron core program has been audited by Certora and Watchpug.