Skip to main content
Even with multiple security audits and formal verification, undiscovered vulnerabilities may exist. Squads maintains a perpetual bug bounty program to incentivize security researchers worldwide to responsibly disclose issues before they can be exploited. Either a demonstration or a valid bug report is all that is necessary to submit. A patch to fix the issue is not required.

​
Bounty rewards

​
Vulnerability categories and rewards

​
Programs in scope

​
Out of scope

  • Encrypted credentials, auth tokens, or similar checked into the repo
  • Bugs in dependencies (report upstream)
  • Attacks requiring social engineering
  • Files, modules, or libraries other than those listed above
  • Already known weaknesses or issues listed in audit reports
  • Issues fixed in newer versions

​
How to report

Do not create a public GitHub issue to report security problems. All vulnerability reports must go through the process below.
1

Contact the team

Send an email to disclosure@sqds.io with your GitHub username and a brief description of the vulnerability. Do not include vulnerability details as email attachments. Enable multi-factor authentication on your GitHub account before submitting.
2

Receive the security advisory

A Squads team member will create a draft security advisory in the appropriate repository (squads-mpl for V3, v4 for V4), add your GitHub user to the advisory, create a private fork for fix development, and respond via email with the advisory link.For audit findings, the same process applies. The advisory title will be prefixed with “[Audit]” and the auditor’s GitHub username will be added.
3

Triage the vulnerability

Within the draft security advisory, discuss and determine severity with the Squads team. The Squads Protocol team makes the final determination on severity and any associated bounty. Additional GitHub users may be added to assist with triage.
4

Develop the fix

Fixes are prepared in private repository branches associated with the draft security advisory. Normal CI procedures are not available in the private repository, so fixes must be built from source and manually verified. Code review from both the reporter and Squads team members is expected.
5

Deploy the patch

A single patch file is prepared for each affected branch. The commit title contains only the advisory ID with no vulnerability details. The fix is deployed to affected programs.
6

Disclose and release

After deployment, patches are merged into the main repository. Public disclosure is made via official Squads channels and a new official release is shipped. The security advisory title is prefixed with the severity category, and the reporter confirms they agree with the severity assessment.

​
Eligibility

Anyone can participate in the bug bounty program, provided they follow the reporting process above and comply with the responsible disclosure policy. Multiple submissions for the same exploit class are eligible but may be compensated at a lower rate on a case-by-case basis. Participants in OFAC-sanctioned countries may not participate in the bug bounty program.

​
Duplicate report compensation

Compensation for duplicate reports is split among reporters, with the first to report taking priority:

​
Payment terms

Bounties are paid out net and reviewed on a rolling basis. Target response time is 24 hours, though some submissions may take longer to assess. Payment is in locked SOL tokens with a 12-month lock period.

​
Responsible disclosure policy

By reporting a vulnerability, you agree to:
  1. Give reasonable time to investigate and mitigate before any public disclosure
  2. Make a good faith effort to avoid security violations and disruptions to others, including destruction of data and interruption of services
  3. Not exploit discovered issues for any reason, including demonstrating additional risk
  4. Not violate applicable laws or regulations
  5. Not be subject to U.S. sanctions administered by OFAC
If you comply with these policies, Squads Labs will not pursue legal action or initiate a law enforcement investigation in response to your report.
Do not test on mainnet with real funds. Use testnet or devnet for testing. Any exploitation of mainnet vulnerabilities, even as proof of concept, violates the responsible disclosure policy.