Safe harbor
Good-faith research within this policy will not be treated as unauthorized access. Stop once you have the minimum proof of impact.
Arc Testnet Responsible Disclosure
Find the problem before mainnet.
BERT's source is open by design. Review the protocol, V3 Community Layer, backend and frontend; report vulnerabilities privately and give us a chance to fix them before public disclosure.
Private first
Do not open a public issue, tweet, or publish a proof of concept before BERT confirms a fix or explicitly approves disclosure.
Reproducible
Reports need clear steps and evidence. A transaction hash, test, trace or screenshot makes triage much faster.
Scope
What we want to hear about.
- Smart-contract bugs: access control, accounting, upgrade safety, reentrancy and invalid state transitions.
- V2/V3 voting, settlement, Treasury, reward, membership and role logic.
- World ID / proof-of-personhood backend validation and signing boundaries.
- Frontend behavior that misrepresents chain state or guides a wallet into an unsafe transaction.
Out of scope
What must not be tested.
- Social engineering, phishing, spam, denial of service or accessing another user's data.
- Known or duplicate issues, missing best-practice headers without impact, and third-party provider issues.
- Using real credentials, private keys, World ID data or anything beyond the minimum testnet proof.
- Claims that testnet USDC or testnet balances have financial value.
Reward model
An initial Validator seat, not a fake cash bounty.
For a confirmed, previously unknown, high-impact report handled responsibly before mainnet launch, BERT may add the researcher's wallet to initialValidators when the official BERT Community is deployed. This is a real contract initialization parameter, so it does not bypass the role model. Validators participate in the Community Layer and can earn the configured validator reward share for validated Member proposals. Seats are limited and subject to conduct requirements. Once that Community is live, any new Validator must follow the normal on-chain eligibility route: earn the local proposal-point threshold as a Member, exit membership, then receive quorum-approved nomination.