Security

peg.fun runs static analysis, symbolic proofs, 50,000-run invariant testing, and mainnet-fork integration tests against every production contract before it deploys — see What we do internally, below, for the full list. That reduces risk; it doesn't remove it. See Risks for the complete posture.

Reporting a vulnerability

If you find a security issue in any peg.fun contract or service, contact us privately first. Public disclosure before remediation puts holders and creators at risk, even when the finding is in our favor.

Do not:

  • Open a public GitHub issue.
  • Post in a public Telegram or Discord channel.
  • Tag accounts on Twitter / X.

Do:

We aim to acknowledge within 48 hours. Critical findings (fund loss, unlimited mint, permanent state corruption) get faster turnaround.

What is in scope

These surfaces are in scope for security review:

  • Smart contracts under contracts/src/:
    • PegFactory.sol, atomic deploy of token + hook + curve + creator vault.
    • PegToken.sol, the ERC-20 + glyph-mint guard.
    • PegHook.sol, bonding curve, migration trigger, fee accumulator, post-graduation routing.
    • DirectSwap.sol, the permissionless router for buy/sell routes that satisfy the glyph-mint guard.
    • PegRenderer.sol, on-chain SVG renderer.
    • TreasuryVault.sol, CreatorVault.sol, fee custody and rotation.
  • Indexer (packages/indexer/), data correctness, RPC trust assumptions, schema invariants.
  • Frontend (packages/web/), wallet-signing security, EIP-712 implementation, AI session token handling.
  • Verification worker (packages/verification-worker/). AI session fee verification.

What is NOT in scope

These are intentional behaviors, not bugs:

  • A buy above the 700-token per-transaction limit reverting. This is a deliberate bound, not a bug — documented in how buying works. Reports of this behavior will be acknowledged but not treated as findings.
  • A liquidity position paying the exit fee, or paying the top (5%) band with no deposit-clock record. Both are deliberate — documented in what LP burn means. An unrecorded position is charged the maximum band by design (never the minimum), so this is not a bypass to report.
  • Burned LP after graduation. This is a feature, not a vulnerability. See LP burn.
  • The locked-forever posture post-migration. peg.fun cannot recover funds, upgrade contracts, touch liquidity, or touch a holder's balance post-graduation — with one narrow, one-way exception over a graduated token's creator fee, documented in Risks and docs/CTO-POLICY.md.
  • Issues that require the founder's seed phrase, signed transactions from the founder's wallet, or any operator-trusted access. These are outside the threat model.

What we cannot offer

  • No funded bug bounty at v1. peg.fun does not run an Immunefi / Cantina / public-bounty pot at this stage. The email channel above is the only path, v2 may reintroduce a funded bounty if treasury TVL warrants it.
  • No formal CVE assignment. Findings are documented in the internal review log after remediation. We will credit you in the patch release notes with whatever attribution you prefer (name, handle, or anonymous).

Responsible disclosure timeline

We follow a standard responsible-disclosure timeline:

  • Acknowledgement: within 48 hours of receipt.
  • Triage and severity classification: within 7 days.
  • Patch and verification: depends on severity. Critical and high-severity findings get priority.
  • Public disclosure: after the patch is deployed and confirmed in production. We coordinate timing with you.

What we do internally

The contracts go through this stack before any production deploy:

  • ≥ 90% Foundry test coverage on src/ overall, ≥ 95% on critical paths (hook, weight math, fee accumulator).
  • 50,000-run invariant testing on the balance-weight math and fee distribution invariants.
  • Halmos symbolic proofs of the vault solvency invariant.
  • Slither + Aderyn static analysis with HIGH/CRITICAL findings blocking CI.
  • Mainnet-fork integration tests against the real Uniswap v4 PoolManager bytecode.
  • Internal line-by-line code review, exhaustive sweep over the production contracts.
  • Public testnet drills before each mainnet ship.

This stack reduces risk but does not eliminate it. It's what "internally reviewed with the strongest tooling we could line up" actually means, in specifics rather than as a slogan.

Related

  • Risks, the long-form trade-off discussion.
  • How peg.fun works, the mechanism every reviewer should read first.