MURI Contracts is a value-bearing smart-contract system. The public source and test suite improve transparency, but publication is not an audit and does not guarantee economic or implementation safety.
Independent reports, when available, are linked from the applicable tagged
release. Deployment status is derived from the finalized receipts under
deployments/4663/.
Use GitHub's private vulnerability reporting flow for this repository:
- Open the repository's Security tab.
- Select Report a vulnerability.
- Include the affected contract and function, impact, required preconditions, a minimal reproduction, and any proposed mitigation.
Do not open a public issue for an unpatched vulnerability and do not test an exploit against public deployments or user funds. If private vulnerability reporting is not enabled, contact the maintainers through a private official MURI channel before sharing technical details.
No bug-bounty payment is promised unless a separate written program says so.
Security fixes target the latest tagged release and the default branch.
Deployed immutable contracts may require a new template or migration instead of
an in-place patch. Canonical deployment receipts are kept under
deployments/4663/.
| Surface | Status |
|---|---|
| OHM-style contracts in the canonical receipt | In scope |
| Miner and Managed Wallet V2 contracts in the canonical release receipt | In scope |
| Managed Wallet V1 | Legacy; report material integration or fund-safety issues |
| Flywheel V2 and Managed Wallet V3 | Deployed release in scope through the finalized Stage 2 and Stage 3 receipts |
| MURI application, X agent, and infrastructure | Outside this contract-only repository |
| Unmodified Pons, Uniswap, or Quiver dependencies | Report upstream; MURI integration failures remain in scope |
Reviews should consider more than isolated Solidity correctness:
- Pons factory, locker, pool, and fee-route assumptions
- Uniswap V3 TWAP availability and manipulation cost
- fixed-supply staking, bond, reward, and reserve solvency
- clone initialization and deterministic-address invariants
- managed-wallet EIP-712 authorization and execution bounds
- guardian, keeper, proposer, timelock, and recovery powers
- Quiver coordinator and randomness-provider trust
- Flywheel accounting, buybacks, routing, and epoch settlement
Good-faith research should use local tests, private forks, or accounts and funds you control. Do not exploit public deployments, access other users' data or assets, degrade service availability, perform denial-of-service testing, or use social engineering. Stop testing and report privately if you encounter live user funds or sensitive information.
MURI will not recommend legal action for accidental, good-faith research that follows this policy, avoids privacy and availability harm, and gives the project a reasonable opportunity to address the report. This policy does not authorize testing against third-party systems and does not waive their terms.