Security disclosure policy
Last updated: 2026-10-17
How to report. Write to security@fairhatch.com, with "Security" in the subject. Include what is affected (a contract address, or a page of the site), the steps to reproduce it, what an attacker could do with it, and, if you have one, a transaction hash on Robinhood Chain Testnet (chain 46630) that shows it. Never send a seed phrase or a private key, to us or to anyone.
In scope.
- testnet-1's contracts on Robinhood Chain Testnet (chain 46630): the launch factory at 0xC1BFdd28572c4157a1E6aBEBe1D16C5a3D350f1b, the contracts it uses (the reference price oracle, the fee router, the graduation gate, the referral registry and the emergency controller), and the tokens, curves and liquidity vaults it creates.
- The test price feed and the test price pool FairHatch runs for testnet-1, and the contract that keeps the pool's price fresh.
- The site testnet.fairhatch.com: its pages, and how it builds the transactions it asks your wallet to sign.
Out of scope.
- Robinhood Chain Testnet itself, its RPC endpoints, explorer, bridge and faucets; WETH (test) and the Uniswap v4 pool manager on this chain, which FairHatch did not deploy; wallet software; Cloudflare; and other services named in our privacy notice. Report those to whoever runs them.
- The servers behind the site and the price keeper: tell us what you notice, but do not test them.
- blog.fairhatch.com: not covered by this policy, but reports about it are welcome at the same address.
- Anything on a mainnet: FairHatch has no contracts on any mainnet.
- Known properties of the testnet, which we do not treat as findings:
- the test price pool is thin, and anyone can move it cheaply; creating then stops until the price is restored, while buying and selling go on;
- creating stops whenever the testnet price keeper does not run;
- a token's name and symbol can copy anyone's, and stay on chain (that is a take-down report, not a security report);
- phone wallets are not supported.
- Reports from automated scanners without a demonstrated impact, and denial-of-service by volume.
Rules for testing.
- Test only on Robinhood Chain Testnet, from wallets you own, with test assets.
- Do not take, lock or destroy other people's test assets beyond the smallest amount that shows the problem, and tell us what you touched.
- Do not overload the site, its servers, or the chain's endpoints and faucets; no load tests.
- Do not try to reach data or systems that are not yours, and do not try to trick people (no phishing, no social engineering).
- testnet-1's source is not published. Work from the deployed bytecode and the site as it is served; we do not send source code.
What we do. We aim to confirm that we have your report within 7 days and to tell you what we found within 30 days. We keep you told when the status changes. testnet-1's contracts cannot be changed: a fault in them is fixed in a later release of FairHatch, not on testnet-1. If a report puts users of this site at risk, we may take the site offline, or pause new launches and new buys on testnet-1, before we reply; selling can never be paused.
Publishing what you found. Please do not publish details of a problem before we have agreed a date with you. If we have not agreed one, you may publish, after telling us, once 90 days have passed since your report, or once the fix is deployed in the release that replaces the affected code, whichever is later.
No bounty. There is no bug bounty for testnet-1. If you wish, we thank you by name once the problem is dealt with.
Who reads reports. FairHatch is a small team: one person reads the reports.
Where this policy applies. This policy covers the public testnet site and testnet-1 only, does not cover any mainnet, and may be replaced.
Language. We read reports in English only.
FairHatch