> For the complete documentation index, see [llms.txt](https://docs.altitude.fi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.altitude.fi/resources/bug-reporting.md).

# Bug Reporting

Security is fundamental to Altitude. We welcome security researchers and advanced users to examine our systems and responsibly disclose any vulnerabilities they find.

{% hint style="warning" %}
**The Altitude bug bounty programme closed.** We no longer offer monetary rewards for vulnerability reports. Reports received before that date are assessed under the terms that applied when they were submitted.
{% endhint %}

We still want to hear from you. If you believe you've found a security issue, please review the guidelines below before getting in touch.

### **How to Report**

Send all reports to [**security@altitude.fi**](mailto:security@altitude.fi) and include:

* A clear **summary** of the issue
* Exact **affected contracts or components** (addresses, repos, commit hashes)
* The **exact file path, function name, and line number** in the current codebase, including the **commit hash** you reviewed
* **Impact analysis** (potential attacker capabilities, affected users, maximum loss)
* A **runnable Foundry test** wherever possible. Reports without execution evidence are unlikely to be triaged
* Any **potential mitigations** you recommend

{% hint style="info" icon="robot" %}
Reports that appear to be generated or primarily drafted by an AI/LLM tool without human verification will be closed without response. You are responsible for verifying every claim against the live codebase before submitting.
{% endhint %}

When performing research:

* Do **not** exploit vulnerabilities on mainnet or production
* Do **not** access, modify, or exfiltrate other users' data
* Do **not** attempt denial-of-service attacks
* Do **not** engage in social engineering of Altitude team members or users

If unsure, contact us before taking any risky action.

### **What We Want to Hear About**

We prioritise issues that could lead to a **loss of funds**, **loss of control**, or **material risk** to Altitude users or the protocol. Some examples:

* Logic errors leading to loss, theft, freezing, or mis-accounting of funds
* Access control failures or privilege escalation
* Unsafe upgrade patterns or incorrect assumptions in integrations
* Issues arising from Altitude's integration with external protocols where the flaw is in Altitude's logic or assumptions

When in doubt, report the issue. If it has real security impact, we will triage it.

### **What We Won't Triage**

To keep the inbox high-signal, we don't respond to:

* Known issues listed in the documentation, repository or previous audit reports
* Issues requiring deployment from a non-trusted source
* Typos, documentation, cosmetic UI issues, visual bugs without security impact
* Vulnerabilities that depend on compromising the user before they interact with Altitude
* Issues solely arising from third-party protocol bugs, where Altitude behaves according to the documented interface
* User-error scenarios involving misuse of contract interfaces
* Theoretical attacks requiring unrealistic assumptions, such as:
  * Economic manipulation beyond plausible conditions
  * Guaranteed MEV/control of transaction ordering
  * Compromise of privileged keys or systems we assume secure
* Gas optimisations, informational findings or micro-efficiency improvements
* User-error scenarios involving misuse of contract interfaces
* Theoretical attacks requiring unrealistic assumptions, such as:
  * Economic manipulation beyond plausible conditions
  * Guaranteed MEV/control of transaction ordering
  * Compromise of privileged keys or systems we assume secure
* Gas optimisations, informational findings or micro-efficiency improvements

### **Recognition**

We don't pay bounties, and submitting a report doesn't create any entitlement to payment. With your consent, we're glad to credit you publicly once a fix is deployed.

### **Safe Harbour**

If you follow this policy in good faith:

* We will not pursue legal action for your security research on Altitude
* We will treat your report confidentially until a fix is deployed
* We will communicate clearly throughout the disclosure process

We ask that you respect our users, limit your testing to what is necessary, and avoid causing harm or disruption.