This document describes the Security Process for Keep3r Network, including vulnerability disclosures and its Bug Bounty program. We are committed to conduct our Security Process in a professional and civil manner. Public shaming, under-reporting, or misrepresentation of vulnerabilities will not be tolerated.

To submit a finding, please follow the steps outlined in receiving disclosures section.

Keep3r Network follows a community standard for responsible disclosure in cryptocurrency and related software. This document is a public commitment to following the standard.

This standard provides detailed information for:

• Initial Contact: how to establish initial contact with Keep3r Network security team.
• Giving Details: what details to include with your vulnerability disclosure after having received a response to your initial contact.
• Setting Dates: how to agree on timelines for releasing updates and making details of the issue public.

Any expected deviations and necessary clarifications around the standard are explained in the following sections.

A bug bounty is hosted on Immunefi at the address https://immunefi.com/bounty/keep3rnetwork.

Vulnerabilities may also be disclosed through the Immunefi platform. Immunefi will then handle bug bounty communications.

Users who violate the rules of participation will not receive bug bounty payouts and may be temporarily suspended or banned from the bug bounty program.

In the case where we become aware of security issues affecting other projects that has never affected Keep3r Network, our intention is to inform those projects of security issues on a best effort basis.

In the case where we fix a security issue in Keep3r Network that also affects the following neighboring projects, our intention is to engage in responsible disclosures with them as described in the adopted standard, subject to the deviations described in the deviations section of this document.

Keep3r Network does not currently have any established bilateral disclosure agreements.

Keep3r Network has a Bug Bounty program to encourage security researchers to spend time studying the protocol in order to uncover vulnerabilities. We believe these researchers should get fairly compensated for their time and effort, and acknowledged for their valuable contributions.

1. Bug has not been publicly disclosed.
2. Vulnerabilities that have been previously submitted by another contributor or already known by the Keep3r Network development team are not eligible for rewards.
3. The size of the bounty payout depends on the assessment of the severity of the exploit. Please refer to the rewards section below for additional details.
4. Bugs must be reproducible in order for us to verify the vulnerability.
5. Rewards and the validity of bugs are determined by the Keep3r Network security team and any payouts are made at their sole discretion.
6. Terms and conditions of the Bug Bounty program can be changed at any time at the discretion of Keep3r Network.
7. Details of any valid bugs may be shared with complementary protocols utilized in the Keep3r Network ecosystem in order to promote ecosystem cohesion and safety.

• Critical: Highly likely to have a material impact on availability, integrity, and/or loss of funds.
• High: Likely to have impact on availability, integrity, and/or loss of funds.
• Medium: Possible to have an impact on availability, integrity, and/or loss of funds.
• Low: Unlikely to have a meaningful impact on availability, integrity, and/or loss of funds.

• Critical: $40,000-$1,000,000
• High: $5,000-$40,000
• Medium: $1,000-$5,000
• Low: $100-$1,000

Paid out in USD equivalent of USDC, DAI, ETH or KP3R.

Actual payouts are determined by classifying the vulnerability based on its impact and likelihood to be exploited successfully, as well as the process working with the disclosing security researcher. The rewards above represent the maximum that will be paid out for a disclosure.

The scope of the Bug Bounty program spans production smart contracts utilized in the Keep3r Network ecosystem.

For exact smart contracts, refer to:

• Keep3r Network
• Keep3r Network v2
• Staking Rewards
• Fixed Forex

Please, refer to following registries:

• Keep3r Network docs
• Fixed Forex docs

Note: Other contracts, outside of the ones mentioned above, might be considered on a case by case basis, please, reach out to the Keep3r Network development team for clarification.

The standard describes reporters of vulnerabilities including full details of an issue, in order to reproduce it. This is necessary for instance in the case of an external researcher both demonstrating and proving that there really is a security issue, and that security issue really has the impact that they say it has - allowing the development team to accurately prioritize and resolve the issue.

In the case of a counterfeiting or fund-stealing bug affecting Keep3r Network, however, we might decide not to include those details with our reports to partners ahead of coordinated release, as long as we are sure that they are not vulnerable.

Additional security-related information about the Keep3r Network project including disclosures, signatures and PGP public keys can be found in the keep3r-security repository.

Parts of this document were inspired by Grin's security policy.