Security

The only feature we never trade off.

No admin EOA anywhere in production. Two independent audits + public Cantina contest pre-mainnet. Continuous bug bounty up to $250k. Coordinated disclosure at security@gitsea.io.

Audit reports ↗Deep dive in docs

Audits

Two firms + a public contest, pre-mainnet.

Trail of Bits

Engaged

Core (RepoVault, Splits, RoyaltyRouter)

Spearbit

Engaged

Credit, Insurance, Markets

Cantina contest

Scheduled

Full surface

Internal review

Continuous

Pre-mainnet

The protocol is on Base testnet ahead of audit completion. Do not deposit anything you can't afford to lose until two completed audit reports + an active bug bounty are published with the mainnet release.

Bug bounty

Up to $250,000 for a critical finding.

Continuous public bounty on Cantina. Payouts in USDC from the protocol treasury.

Critical

$250,000

Direct theft from any vault · $GSEA mint bypass · timelock bypass

High

$50,000

Block governance · global score manipulation · bypass slashing

Medium

$10,000

Material griefing · market price manipulation

Low

$1,000

Single-repo DoS · non-critical UI inconsistency

Separate · Sybil bounty

Cluster ≥ 50 DIDs

$20,000

Cluster ≥ 10 DIDs

$5,000

Single sybil

$500–$2,000

Successful claims also slash the bonds of any DID that vouched for the cluster.

Threat model

How we think about the things that could go wrong.

Repo takeover

Multi-maintainer splits-change requires 2 signers + 24h timelock for >25% reweights. Repo-owner transfer is explicit, never silent.

Stream griefing

Usage telemetry is opt-in beacons cross-checked against the commit graph. Unverified streams cap at fallback rate. RoyaltyRouter authority is gated by RepoVault's authorized set.

PR market manipulation

Counterparty graph analysis. Author-merger conflict-of-interest slashes profits. Round-tripping detected by timing + counterparty heuristics.

Insurance griefing

Optimistic claims with claimant bond. Curator multisig review with slashing for false claims.

Credit score sybil

Soulbound credentials require a separate merger to sign. Vouching is bonded — proven sybil clusters burn the voucher's bond. Public sybil bounty.

Governance capture

Quorum + timelock + culture of off-chain temp checks. Emergency multisig with rotation, can only pause specific subsystems for 24h, never move funds.

Full STRIDE/DREAD analysis lives at gitsea/security/threat-model.md once we publish it post-audit.

Operational

What runs in production.

→No admin EOA anywhere in the production stack.
→Deployer keys rotate post-deployment; addresses become immutable owners of upgrades through the timelock.
→Oracle operators run independent infrastructure — no shared hosting.
→Emergency multisig (5-of-9, public roster) can pause specific subsystems for 24h max, never move funds, never mint $GSEA.
→Public incident runbooks.

Disclosure

How to reach us.

→Vulnerabilities → security@gitsea.io (PGP fingerprint at /security/pgp).
→90-day default disclosure window. We publish after fix.
→Website / bot / API issues? Same address. Coordinated disclosure, never legal threats.
→For bounty submissions, use the Cantina form — the email is reserved for first-contact and time-sensitive issues.

Find something? Get paid for it.

The bug bounty is for the public — independent researchers, users, agents. Anyone who can prove an issue can claim.

Disclose →Read the docs