Security and Bug Bounty

InstaSwap moves user funds through programmatic escrow contracts that have been audited by Hashlock (report to be published) and are guarded by independent approver signers. We still assume we can be wrong. If you find a way to steal, freeze or misroute funds, or to take over an account, we want to hear it first and we will pay for it.

1. How to report

Email the details to the address below with the subject line "Security report". Include the affected component, the chain and contract address where relevant, step by step reproduction, and a proof of concept (a forked chain test, a request trace or a short script). If you need an encrypted channel, ask for one in your first email and we will set it up before you send details.

Report to: support@instaswap.com

2. What to expect from us

We acknowledge every report within 2 business days and give a first severity assessment within 7 days. Critical issues are mitigated immediately (deposits can be paused and custody drained to refunds while a fix is prepared) and the fix is re-tested by our auditors before the issue is closed. You get a status update at every step and a final summary when the issue is resolved.

3. Scope

In scope:

• The escrow factory contracts and their escrow implementations listed in section 6, on every chain where they are deployed.
• The approval layer: any way to make a guarded escrow call succeed without the required number of independent approver signatures, or to make approvers sign a harmful call.
• The public API and backend (api and walletlessapi subdomains of instaswap.com) where the impact touches funds: payouts to the wrong recipient, fee bypass, double payment, refunds to the wrong address, or manipulation of a quote that leads to a loss at execution.
• instaswap.com, the partner portal and the explorer: authentication bypass, account takeover, exposure of other users' data.

Out of scope (not rewarded):

• Denial of service, rate limiting, spam and anything that needs excessive traffic.
• Phishing, social engineering, physical attacks, and issues in third-party venues, bridges, networks or wallets that InstaSwap routes through or integrates with.
• Design decisions that are documented in section 7, including the roles of the owner key and the operator key.
• Retired contract generations, test networks, best-practice recommendations without a demonstrated impact, self-XSS, missing security headers, and findings from automated scanners without a working proof of concept.

4. Severity and rewards

Severity is decided by InstaSwap from the demonstrated impact and the likelihood of exploitation. Amounts are in USD and are paid in USDC or USDT on a supported chain of your choice.

5. Payment terms

• The first valid report of an issue is rewarded. Duplicates and issues already known to us are not.
• Rewards are paid within 14 days after the fix is confirmed. For rewards above 2,000 USD we ask for identity verification before payment, and we cannot pay persons or entities under sanctions.
• Several reports that share one root cause count as one issue.
• InstaSwap may pause or change this program at any time. Any pause is announced on this page and reports received before the pause are honoured under the terms that applied when they were sent.

6. Audited contracts in scope

The current escrow generation was audited by Hashlock (report to be published). Source code is verified on each block explorer and published in the audit repository. Every factory below deploys one minimal escrow per order from the implementation shown.

Audit repository: github.com/Instaswap-Labs/instaswap-escrow-audit

7. Known design decisions

The following are intentional and documented, and are not rewarded on their own. Reports that show how one of them can be abused beyond its intent are welcome.

• Each factory has one owner key held on a hardware wallet. Changes that loosen security (approver set, treasury, operator) take effect only after a 48 hour public delay; the only instant owner action is pausing.
• Routine escrow calls are sent by an operator key, but every call that moves funds must carry signatures from 3 of 4 independent approver signers that re-check the order against our records before signing.
• Every escrow commits the user's refund address at creation. After the refund timeout anyone can trigger the refund to that address, so funds can never be stuck behind InstaSwap.
• Swaps execute on third-party liquidity venues and networks. Their availability, pricing and slippage are outside this program.

8. Rules and safe harbour

• Test only against your own orders and funds. Do not access, modify or delete data that belongs to other users, and do not degrade the service.
• Demonstrate on-chain issues on a forked chain or with minimal amounts. Never exploit an issue on mainnet against real user funds.
• Give us at least 90 days to fix the issue and do not publish details before we confirm the fix. We are happy to credit you publicly when it is resolved, if you wish.
• Research that follows these rules is authorised. We will not pursue legal action against good faith researchers and we will not report them to authorities for their research.

Security reports and questions about this program: support@instaswap.com