Skip to navigation
Security General Information

Vulnerability Disclosure Policy

Agora welcomes responsible reports of security vulnerabilities. Please give us an opportunity to investigate and address an issue before disclosing it publicly.

Assets in scope

Only the specific assets above are in scope. Other Agora domains, APIs, testnets, repositories, and third-party services are not included unless expressly listed.

How to report

Email vulnerability-disclosure@agora.finance. Do not submit vulnerability details through support, social media, or public issue trackers.

Include the affected asset and network, the potential security impact, clear reproduction steps, and a minimal proof of concept where practical. For an onchain issue, include the relevant contract address and use a local fork or another non-disruptive demonstration. Send one vulnerability per report unless several issues must be combined to demonstrate their impact.

Research rules

  • Use only accounts, wallets, and data you own or are authorized to use. Do not access, copy, alter, or retain anyone else’s data beyond the minimum needed to identify an issue.
  • Do not move or put at risk user funds, mint or transfer assets without authorization, change permissions, or exploit a vulnerability on mainnet.
  • Do not degrade availability or use denial-of-service attacks, high-volume scanning, spam, phishing, social engineering, or physical attacks.
  • Do not test third-party infrastructure, including wallet providers, chain infrastructure, explorers, and bridge operators, merely because it connects to an in-scope asset.
  • Stop testing and report promptly if you encounter sensitive data, a risk to funds, or a risk of service disruption.
  • Keep the report and vulnerability details confidential. Coordinate any public disclosure with Agora and obtain our written agreement before publishing details.

This program authorizes only research that stays within the listed scope and follows these rules. It does not grant permission to test third-party systems or disregard applicable law.

Program exclusions

We welcome reports of material security impact. The following are generally ineligible unless the report demonstrates a concrete, exploitable impact on an in-scope asset:

  • Issues affecting assets outside the stated scope, including testnets and third-party systems
  • Duplicate reports, issues already known to Agora, or issues already publicly disclosed
  • Theoretical attacks without a practical attack path or demonstrated impact
  • Missing security headers, email security records, or other hardening recommendations on their own
  • Version disclosure, verbose errors, stack traces, or public information that does not expose sensitive data
  • Clickjacking on pages without sensitive actions; self-XSS; logout CSRF; and open redirects without additional security impact
  • Rate-limit observations that do not demonstrate a meaningful security impact
  • Expected behavior of documented privileged contract roles, absent a bypass or other vulnerability
  • Market movements, depegging, or economic losses that do not result from a vulnerability in an in-scope asset

Do not perform hazardous testing to prove an otherwise excluded issue. If you are unsure whether a finding is eligible, email us with a non-disruptive description first.

Safe Harbor

Any activities conducted in a manner consistent with this Policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this Policy, we will take steps to make it known that your actions were conducted in compliance with this Policy.

Review and rewards

Agora will review reports and may contact you for more information. Agora may, at its sole discretion, award a bounty for a report. No report or finding guarantees a reward. Multiple reports arising from the same underlying issue may be treated as one finding.

Agora may update or suspend this program. Changes to the program will be published on this page.