We recommend always running the latest deployed version of OneSIP. Smart contracts are versioned by their published Move package ID.

If you discover a security vulnerability in OneSIP — whether in the Move smart contracts (contracts/sources/), the off-chain API layer (app/api/), or the frontend — please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities. Instead, report privately via a GitHub Security Advisory or by contacting the maintainer directly through GitHub.

• Type of vulnerability (e.g. reentrancy-equivalent state race, access-control bypass, integer overflow)
• Affected module/file and function name
• Steps to reproduce, ideally with a Move test case or API request
• Potential impact (funds at risk, unauthorized access, etc.)
• Your contact information for follow-up

1. Acknowledgment within 48 hours
2. Triage & severity assessment
3. Fix development and testing (including a regression test in contracts/sources/ where applicable)
4. Coordinated disclosure — we will not publicly disclose details until a fix is deployed
5. Credit to the reporter (if desired) in the release notes

In scope:

• Move contracts: contracts/sources/sip_manager.move, yield_router.move, lock_vault.move
• Off-chain API routes: app/api/**
• Frontend wallet-signing flows: components/, hooks/, lib/
• Deployment configuration: Dockerfile, docker-compose.yml, nginx.conf, netlify.toml

Out of scope:

• Vulnerabilities in upstream dependencies (report to the OneChain / Sui / Next.js maintainers directly)
• Denial-of-service reports without a reproducible exploit
• Social engineering or phishing attacks targeting users
• Issues that require a compromised wallet private key as a precondition

• Emergency vault unlock requires a minimum 7-day (MIN_LOCK_DURATION) time-lock, enforced on-chain — this is a deliberate design trade-off between fund availability and theft resistance, not a bug.
• Multi-sig emergency unlock requires 3-of-5 (REQUIRED_APPROVALS) independent guardian approvals — guardian key management is currently the responsibility of the vault owner.

Thank you for helping keep OneSIP and its users safe. 🙇