DO NOT open a public GitHub issue for security vulnerabilities.

If you discover a security vulnerability in the MCC Protocol, please report it responsibly:

Send details to: security@mcc-protocol.org

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 5 business days
• Fix timeline: Depends on severity (critical: 24-72 hours)

The following are in scope for security reports:

• Issues in dependencies (OpenZeppelin) — report to them directly
• Issues requiring social engineering
• Denial of service via gas griefing (known limitation)
• Front-running of public mempool transactions (inherent to Ethereum)

We plan to launch a formal bug bounty program on Immunefi before mainnet.

Until then, valid security reports will be recognized in our Hall of Fame and may be eligible for retroactive rewards after token launch.

See AUDIT_PREP.md for our security architecture, known considerations, and audit preparation status.

• Slither — static analysis (runs on every PR)
• Mythril — symbolic execution
• Foundry — fuzz testing (100K+ iterations)
• OpenZeppelin contracts v4.9 — battle-tested base contracts

We thank the following researchers for responsible disclosures:

No reports yet — be the first!