Security

If you have found a way to lose, freeze or steal funds in Paboxo, or to make the app or the indexer show something false, please tell us before anyone else.

Report a vulnerability

Email [email protected]. It is the address we monitor; a report sent anywhere else may not reach us. A subject line starting with Security: helps it stand out.

Please include:

• what is affected: the contract and its address (see contracts), or the page or endpoint;
• what an attacker gains, and what they need first (funds, a position, a role, timing);
• steps or a proof of concept that reproduces it, ideally a Foundry test against a local fork of Robinhood Chain mainnet (chainId 4663);
• how you would like to be credited, if at all.

Please do not exploit the issue beyond what is needed to show it, and do not disclose it publicly until it is fixed and we have agreed a date with you.

The same address is in /.well-known/security.txt.

What happens next

• We acknowledge every report within 72 hours.
• We tell you whether we can reproduce it, what we plan to do, and keep you updated until it is fixed.
• If funds are at risk, the affected market can be paused at once while a fix is prepared (see emergency powers).

Safe harbor

Research done in good faith and within this policy will not be pursued legally by the Paboxo team. That means:

• test against your own positions or a local fork, never against other users' funds or positions;
• no social engineering, phishing or physical attacks against the team or its users;
• no denial of service against the app, the indexer or the RPC endpoints, and no automated traffic heavy enough to degrade them;
• stop and report as soon as you have shown the issue, and do not keep or share any data that is not yours.

If you are unsure whether something is in bounds, ask first at the same address.

Rewards

Valid reports are credited publicly, with your consent, and may be rewarded at the team's discretion, depending on impact and on the quality of the report.

Scope

In scope:

• the mainnet contracts listed on contracts, including the Earn vault and the LP collateral markets;
• the app at app.paboxo.xyz;
• the indexer at indexer.paboxo.xyz.

Out of scope: Robinhood Chain itself, Chainlink's feeds, Uniswap, the Stock Tokens and USDG, and any wallet. Report those to their own teams. Intended behaviours are described on status and risks.

Emergency powers

The emergency controls, and who holds them:

• Any lending pool can be paused instantly by a pauser key. It holds PAUSER_ROLE on every lending pool and no other role on any contract the protocol uses. A paused market stops supplying, withdrawing, borrowing, repaying and liquidating until it is resumed. Interest keeps accruing while it is paused.
• Only the protocol Safe can resume a market. The pauser key cannot unpause, change a parameter, move funds or upgrade anything.
• Everything else (risk and rate parameters, price feeds, listings, upgrades, the Earn vault's curation) is held by the protocol Safe, a 2-of-4 multisig.

Who holds which role, read from the chain, is on governance & admin.