Bug bounty

programme terms These are the terms governance intends to operate from the first public testnet onward. Until the programme is announced live on this page and on note.systems with a start date, they are a statement of intent, not an offer. Rewards are funded from the Ecosystem bucket and paid in USDG and/or NOTE. Reward figures are not published; request the reward schedule from security@note.systems.

The programme rewards researchers who find and privately report vulnerabilities in the Note Systems contracts before anyone else can use them. It sits alongside the testing methodology, the invariant suites, the internal security review reports under audit/ and the planned external audits. Reports are submitted through the channels on the vulnerability disclosure page.

Programme at a glance

Item	Value
Status	not yet live, opens with the first public testnet
Rewards	Determined per report by severity and launch phase; request the reward schedule from security@note.systems
Funding	Ecosystem bucket, see Tokenomics, plus USDG from Treasury on governance approval
Currency	USDG and/or NOTE at the researcher’s election, subject to available funding
Submission	security@note.systems (PGP), first contact also via @notesystems on X, see disclosure
Acknowledgement	24 hours
Triage and severity	72 hours
Payout	14 days from severity confirmation, after KYC where required
Safe harbour	Yes, for research within the rules below

Scope

In scope are the contracts in contracts/src deployed at the addresses on the Addresses page, at the commit tagged for that deployment. A finding must be reproducible against that code.

Area	Contracts	Notes
Core	NoteCore, NoteLegs, SeriesRegistry, Governed	Immutable escrow. Highest weight: the escrow invariant
Oracle	OracleAdapter, MarketCalendar	Observation logic, walk-back, deferral and force paths
Token	NOTE, sNOTE, Treasury, BondDepository, RevenueRouter, Desk, UUPSModule, GovernedUpgradeable	Supply cap, floor redemption, buyback auction, Desk NAV
Governance	veNOTE, GaugeController, gauges, Minter, EmissionSchedule, NoteGovernor, UpgradeGovernor, timelocks	Vote weight, emission caps, proposal and upgrade authority
Launch custody	VestingVault, CustodyTimelock	Schedule math, owner release paths, timelock delay and role separation
Automation	RollPolicy, NoteAutomation, the lazy crank and seriesCreator paths in NoteCore	Template-driven series rolls, permissionless checkUpkeep/performUpkeep, bounty custody, crank-in-exit gas bounds. There is no protocol-run keeper; any account may call these

Libraries (FixedPointMath, DateTimeLib) and interfaces are in scope where a defect is reachable through an in-scope contract.

Out of scope

• Front-end, documentation, this site and the app, except where a front-end defect leads directly to loss of funds through an in-scope contract.
• Third-party contracts and infrastructure: Stock Tokens and their issuer, USDG, Chainlink feeds, Robinhood Chain sequencer and bridge, RPC providers.
• Code under contracts/src/mocks, contracts/test, contracts/script, and any deployment not listed on the Addresses page.
• Findings that require a privileged key (owner, guardian, timelock, sale admin) to act maliciously or be compromised, unless the finding shows the privilege exceeds what the governance documentation states.
• Oracle price manipulation of the underlying market itself; stale or wrong data delivered by a feed operating within its published parameters.
• Gas optimisations, best-practice deviations without a security impact, compiler warnings, floating pragma, missing events, and issues already listed in static analysis or the internal security review reports under audit/ as acknowledged.
• Denial of service that depends on a chain-level failure, a block gas limit change, or a sequencer outage.
• Anything already reported. Duplicates are paid once, to the first complete report; later reporters are credited.

Severity matrix

Severity follows impact first, then likelihood. The triage team assigns it; the reporter may appeal once with new evidence.

Severity	Impact	Reward
Critical	Direct theft or permanent freezing of escrowed principal, coupons, Desk assets or Treasury reserves. Unauthorised NOTE minting or bypass of the hard cap. Settlement at a wrong price or wrong leg with loss. Governance or upgrade authority taken without the documented vote and delay	Determined per report; request the reward schedule from security@note.systems
High	Theft or freeze of unclaimed yield, fees or rewards. Wrong coupon, NAV or vesting math with loss to some users. Bypass of a cap, delay, pause or cooldown. Griefing that permanently blocks a series, gauge epoch or auction	Determined per report; request the reward schedule from security@note.systems
Medium	Temporary denial of settlement, claims or exits recoverable without loss. Incorrect accounting that does not move funds. Manipulable view functions relied on by upkeeps (checkUpkeep, previewRoll, dueWork) or the app	Determined per report; request the reward schedule from security@note.systems
Low	Informational findings with a plausible security path, incorrect events or error selectors, documentation that contradicts contract behaviour in a way a user could lose from	Determined per report; request the reward schedule from security@note.systems

Within a severity the reward depends on funds at risk, the quality of the proof of concept, and whether the report includes a tested fix. Funds at risk is the USD value, at the time of the report, of the assets the vulnerability could have moved or frozen, measured at Chainlink prices and the Desk’s pricePerShare. Where the exploit is repeatable, the value is the total reachable, not one transaction.

Launch phase

Rewards scale with the launch phase of the deployment the finding is reproduced against: public testnet, mainnet guarded launch, and mainnet full. Findings on testnet, where no user funds are at risk, are rewarded at the base level for their severity; reports that include a tested fix earn more. Rewards rise as series and Desk caps are lifted on mainnet. The current phase is stated on the Addresses page next to each deployment. Medium and Low findings are rewarded at triage discretion in every phase. The reward schedule for each phase is provided to researchers on request at security@note.systems.

Payment

• Paid in USDG, NOTE, or a mix, as the reporter elects when the severity is confirmed. NOTE is valued at the 7-day time-weighted average of the buyback auction clearing price, or, before the auction is live, at the most recent sale price in Tokenomics.
• NOTE paid as a reward is liquid at payout; no vesting applies to bounty rewards.
• If available funding is below the confirmed amount, the shortfall is proposed to governance from the Ecosystem bucket within the 14-day payout window and the reporter is told the vote date.
• Payouts above a threshold communicated on confirmation require identity verification (KYC) and a sanctions screen. All payouts require a wallet on Robinhood Chain and, where the reporter’s jurisdiction requires it, a tax form. Note Systems does not pay residents of sanctioned jurisdictions.
• Rewards are gross of the reporter’s taxes.

Rules of engagement

1. Do not exploit on mainnet. No transaction that moves, freezes or mis-prices user funds, however small, and no testing against contracts that hold third-party assets. A mainnet exploit forfeits the reward and the safe harbour.
2. Prove it on testnet or a fork. Reproduce the finding on the public testnet deployment or on a local fork (forge test --fork-url). A Foundry test in the style of contracts/test is the preferred proof of concept.
3. Report privately, once, through a channel on the disclosure page. Do not disclose publicly, to other teams or to the press until a fix is deployed and the coordinated disclosure timeline has run.
4. No social engineering, phishing, physical attacks or attacks on Note Systems staff, contributors or infrastructure providers.
5. No automated scanning against production RPC endpoints at a rate that degrades service.
6. One finding per report. Chains of findings that together produce a higher-severity result may be submitted as one report and are paid at the combined severity.
7. Reporters must not be a current or former core contributor, auditor engaged on the code, or a person with prior privileged knowledge of the finding, and must be old enough to contract in their jurisdiction.

Safe harbour

Research carried out in good faith and within the rules above is authorised. The Note Systems governing entity will not pursue civil or criminal action or complain to law enforcement about such research, will treat it as compliant with the terms of use of the site and app, and will not seek to identify a pseudonymous reporter beyond what KYC for payment requires. If a third party brings action against a researcher for activity covered by this safe harbour, Note Systems will confirm in writing that the activity was authorised. The safe harbour does not extend to third-party systems, and it does not cover any activity that breaches rule 1.

Response and payout SLAs

Step	Target
Acknowledgement	24 hours from receipt, with a report identifier
Triage and provisional severity	72 hours
Fix plan communicated	7 days for Critical and High
Payout	14 days from severity confirmation and, where required, completed KYC
Coordinated public disclosure	90 days from report, or earlier by agreement once a fix is deployed; see disclosure

Missed SLAs are reported at the next governance call together with the reason.

Governance of the programme

The programme’s terms, funding and severity decisions are administered by a security committee of three appointed by governance; two must agree on any Critical or High payout. Changes to these terms take effect for reports received after the change is published here. Aggregate report counts, anonymised, are published quarterly on this page.

Quarter	Reports	Critical	High	Medium	Low
—	0	0	0	0	0