Bug Bounty
Read to learn more about the GoldLink Bug Bounty Program and how to submit a report.
GoldLink Protocol is an undercollateralized on-chain prime brokerage, which allows lenders to take on exposure to protocols and strategies they have specifically allocated to and borrowers to effectively run trading strategies as they would in-house, with leverage to amplify their returns.
For more information about GoldLink, visit https://www.goldlink.io/
To use the Dapp, please visit app.goldlink.io/
To view the documentation visit docs.goldlink.io/
To view the dev docs visit dev.goldlink.io/
Overview
The security of GoldLink Protocol and its smart contracts are of utmost importance to us. For that reason we have established the GoldLink Bug Bounty (the ”Program”) to incentivize responsible bug disclosure.Rewards will be allocated based on the severity of the bug disclosed and assets at risk. Rewards can be up to 50,000 USDC.
Scope
The Program includes vulnerabilities and bugs in any deployed GoldLink contract. These include those within the following GitHub repositories:
Core Contract Code
GMX Strategy Contract Code
However if you find a bug in a GoldLink smart contract outside of these repositories, where user funds are at risk, the team will consider the issue to be in-scope for our bounty.
Rewards
The Program includes the following 4-level severity scale:
Critical: Issues that could impact numerous users and have serious reputational, legal or financial implications. An example would be being able to lock contracts permanently or take funds from all users.
High: Issues that impact individual users where exploitation would pose reputational, legal or moderate financial risk to the user.
Medium: The risk is relatively small and does not pose a threat to user funds.-
Low: The issue does not pose an immediate risk but is relevant to security best practices.
Rewards will be given based on the above severity as well as the likelihood of the bug being triggered or exploited, to be determined at the sole discretion of GoldLink.
Eligibility
To be eligible for a reward under this Program, you must:
Discover a previously unreported, non-public vulnerability that is not previously known by the team and is within the scope of this program.
Be the first to disclose the unique vulnerability to security@goldlink.io, in compliance with the disclosure requirements.
Provide sufficient information to enable our engineers to reproduce and fix the vulnerability.
Not exploit the vulnerability in any way, including through making it public or by obtaining a profit (other than a reward under this Program).
Not publicize a vulnerability in any way, other than through private reporting to us.
Make a good faith effort to avoid privacy violations, data destruction, and interruption or degradation of any of the assets in scope.
Not submit a vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program.
Not engage in any unlawful conduct when disclosing the bug to security@goldlink.io, including through threats, demands, or any other coercive tactics.
Be at least 18 years of age or, if younger, submit your vulnerability with the consent of your parent or guardian.
Not be subject to US sanctions or reside in a US-embargoed country.
Not be one of our current or former employees, or a vendor or contractor who has been involved in the development of the code of the bug in question.
Comply with all the eligibility requirements of the Program.
Terms
By submitting your report, you grant GoldLink Protocol any and all rights, including intellectual property rights, needed to validate, mitigate, and disclose the vulnerability. All reward decisions, including eligibility for and amounts of the rewards and the manner in which such rewards will be paid, are made at our sole discretion.
The terms and conditions of this Program may be altered at any time.
Last updated