Responsible disclosure
If you find a vulnerability in Mooner's contracts, the website or its services, report it privately before anyone can exploit it.
How to report
Send a direct message to Miracle on X with:
- a description of the issue and its impact;
- the steps or a transaction that reproduces it;
- your X handle, if you would like a public thank-you.
Do not disclose the issue publicly until it is fixed. We aim to answer within 72 hours.
The Mooner team will never message you first, and will never ask for your recovery phrase, your private key or a payment. Anyone who does is not us.
Rules
- Test only on the HyperEVM testnet or with your own funds. Never touch other users' funds or data.
- No denial-of-service, spam or social engineering.
- Acting in good faith under these rules, you will not face action from Mooner.
Scope
| In scope | Out of scope |
|---|---|
| Mooner's contracts | Third-party contracts (Project X, wallets, terminals) |
| Funds held by the launchpad and the graduation contract | The price or performance of any coin |
| The launch service and its checks | Issues that need a compromised user device |
| The website and its APIs | Missing best practices with no concrete impact |
Recognition
Mooner is self-funded and does not pay bounties yet; a funded bug bounty is on the Roadmap. People who report a valid issue are thanked publicly on this page, if they want to be.