Write to info@ivy.live. Include the contract address, the function involved, and the steps to reproduce. If you have a proof of concept, a Foundry test is the most useful form.

Please do not open a public issue for a vulnerability that is still exploitable. Give us a chance to look at it first.

We will acknowledge your report and tell you what we intend to do about it. We do not run a paid bounty programme today; if that changes it will be announced on ivy.live.

In scope: the contracts in this repository, as deployed at the addresses listed in README.md and deployments/8217.json.

Not in scope: the web application, the mobile shell, and any third party the product depends on (Kaia itself, DragonSwap, wallet providers). Report those to info@ivy.live as well, but they are not covered by this file.

These are deliberate design decisions, not findings. Reporting them is welcome but they will not be treated as vulnerabilities.

The revenue contracts cannot be fixed. They are non-upgradeable and ownerless. If a bug is found in one of them, the only remedy is to deploy a replacement and migrate. We accepted this in exchange for being unable to change the rules after the fact.

IvyConverter has no recovery path. It has no withdraw, sweep or rescue function, and no claim deadline. Tokens belonging to a lost wallet stay locked forever, and tokens sent to the contract by mistake cannot be returned. Nobody, including us, can move them.

Four contracts have an owner. IvyRegistry, IvyVerifier, IvyUsername and IvyGameRegistry expose an owner, and the first three are currently held by an externally owned account rather than a multisig. This is stated in the README along with exactly what each owner can do. Migration to a 2 of 3 Safe is planned.