// LEGAL

Report Security Issue

Found a vulnerability in Stardust? Report it privately here.

Last updated: 29 October 2026

Please don't post vulnerabilities in public issues, on X or in other public channels. Report them privately so users stay safe while we fix them.

How to report#

  1. Preferred: GitHub private report. Open a private security advisory on the contract-stardust repository. Only our team can see it.
  2. Or a direct message to @stardustRH on X. Say that you have a security report and we'll set up a private channel for the details.

What to include#

  • What is affected: the URL, API endpoint or contract address
  • What an attacker could do, and how bad it is
  • Step-by-step reproduction. For contracts, a Foundry test on a mainnet fork is ideal
  • Any logs, requests or transaction hashes that help
  • How you'd like to be credited (or that you'd rather stay anonymous)

Funds at risk right now?#

If an issue could cost users money on mainnet, say URGENT in the first line. We can pause the EnergyStore, the EnergyVault deposits and NFT minting while we fix it. The Liquidity Pool has no owner and can't be paused, so tell us about it first in any case.

What happens next#

We follow the timeline in our Responsible Disclosure policy: acknowledgement within 3 business days, updates while we work, and credit once it's fixed.