Security and bug bounty
If you find a vulnerability in Imperial, tell us privately and we will fix it, credit you if you want, and pay you according to the table below.
Reporting
Email hunter@bj.xyz. Include:
- What the issue is and what an attacker gains from it.
- A proof of concept, or exact steps to reproduce.
- The affected program or endpoint, and the commit or transaction if you have one.
What you can expect from us:
- An acknowledgement within 48 hours.
- An initial severity assessment within 5 business days.
- A status update at least once a week until the issue is resolved.
- Critical issues are fixed as fast as possible; we can pause the protocol while we do.
- Coordinated public disclosure once a fix is deployed: by default after 90 days, or sooner if we agree.
In scope
The on-chain programs on Solana mainnet, at their currently deployed versions. Each is built reproducibly, so the deployed bytes can be matched to a commit.
- Passthrough
pASsDHVUtgG5uomQ29SVMv1sQxon4Gi6g5bJV7KKqZ8 - Imperial propAMM
ARmavNtb6xs7SpH3geahw434fwTrVw5BSvJf36CAbWKB - Pawn
LendieSENLn3KLWTKrxHL2hD6w2YgyP2f9MaiVHEZg6
Also in scope:
- The imperial.trade and imperial.space web apps, and the api.imperial.trade and api.imperial.space APIs.
- Any way for the protocol's operator key to exceed its documented on-chain limits: the profit hold and caps, the profile SOL reclaim cap, fee pinning, or pinned destinations.
- Any way for a guardian key to unpause a program, or to do anything other than pause.
Out of scope
- Third-party venues and dependencies: Phoenix, Lighter, Pyth, Jupiter, and the Solana runtime itself. Report those to their teams.
- Attacks that require a compromised admin or upgrade key, or the victim's own key.
- Frontend cosmetic or UI bugs without a security impact.
- Volumetric denial of service, or spamming RPC endpoints.
- Social engineering or phishing of our team, and physical attacks.
- Issues already known to us or already reported.
- Best-practice suggestions without a demonstrated impact.
- Staging and devnet deployments.
Rewards
| Severity | Example | Reward |
|---|---|---|
| Critical | Theft or permanent freezing of user or pool funds | $10,000 – $25,000 |
| High | Theft of yield or fees, or temporary freezing of funds | $2,500 – $5,000 |
| Medium | Griefing that costs users or the protocol money, or bypassing a documented limit | $500 – $1,000 |
| Low | Minor issues with no funds at risk | Thanks, or up to $100 |
- Rewards are paid in USDC.
- Within a tier, the amount is at our discretion, based on impact, likelihood and the quality of the report.
- Only the first valid report of an issue is rewarded. Duplicates and known issues are not.
- We may require identity verification and sanctions screening before paying.
Rules and safe harbor
- Test only against your own accounts, and use the smallest proof of concept that shows the issue.
- Prefer a local fork (surfpool, litesvm, or solana-test-validator) over mainnet.
- Never move, freeze or put at risk funds that are not yours.
- Do not disclose the issue publicly before it is fixed.
- Good-faith research under these terms will not be pursued legally.
- Demands for payment before disclosing an issue void any reward.