Security and Bug Bounty

Security matters at Manna ("Manna", "we", "us"). This page explains how we protect users, and how security researchers can report vulnerabilities to us responsibly. It is part of the Terms of Service. For a user-facing guide to staying safe, see Security.

1. How to report a vulnerability#

Email hi@mannas.fun with the subject line starting with "Security". [TODO: owner to insert dedicated security email and PGP key, if any]

Please include:

1. 1a clear description of the issue and its impact;
2. 2the affected component (URL, API endpoint, bot command, contract or program address and chain);
3. 3step-by-step instructions to reproduce it, with any proof-of-concept code, transaction hashes or screenshots;
4. 4the wallet address or account you used for testing; and
5. 5how you would like to be credited, and a wallet address for any reward.

Do not include other users' personal data or keys in your report. If the issue puts user funds at immediate risk, say so in the subject line ("Security: urgent") so we can prioritize it.

2. What happens after you report#

• We aim to acknowledge your report within 3 business days.
• We will then assess the report, tell you the severity we assign, and keep you updated while we work on a fix.
• We will tell you when the issue is fixed, and agree with you when and how it can be disclosed.
• If we decide the report is out of scope, a duplicate, or not a vulnerability, we will tell you why.

Duplicate reports are rewarded only for the first complete report we receive.

3. Scope#

4. Rules for researchers#

To stay within safe harbor (section 5), you must:

• only test against accounts and wallets you own, or that you have explicit permission to use;
• not access, change, delete or keep other users' data, funds or keys. If you accidentally access someone else's data, stop, do not keep it, and tell us in your report;
• not exploit a vulnerability on mainnet beyond the minimum needed to prove it, with the smallest possible amounts and your own funds. Prefer testnets, local forks or simulations. Never drain, freeze or move funds that are not yours;
• not run denial-of-service attacks, high-volume automated scans, or anything that degrades the Service for others;
• not use social engineering, phishing or physical attacks;
• give us reasonable time to fix the issue before you disclose it, and not disclose it publicly (or to anyone else) before we have fixed it and agreed on disclosure;
• not demand payment or threaten disclosure in exchange for a report (that is extortion, not research); and
• follow all applicable laws, and not be a sanctioned person or in a sanctioned region.

5. Safe harbor#

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will not ask law enforcement to take action against you. If a third party takes legal action against you for research that followed this policy, we will make it known that your actions were authorized by us. This safe harbor covers Manna's own systems only. It does not cover third-party services, and it does not authorize breaking any law. If you are unsure whether something is allowed, ask us first at hi@mannas.fun.

6. Rewards#

We pay rewards for valid, in-scope vulnerabilities at Manna's discretion. The amount depends on severity, the quality of the report, and the actual impact. Reward ranges: [TODO: owner to insert bug bounty reward ranges].

• Rewards are paid in a token and on a chain we choose, to a wallet you provide.
• To receive a reward you must be the first to report the issue, follow the rules in section 4, not be a current or former Manna team member or contractor (within the last 12 months), and not be a sanctioned person. We may require identity or tax information where the law requires it.
• You are responsible for any taxes on rewards.
• We may publicly thank you, with your permission.

7. Severity guide#

We assess severity using impact and likelihood. The examples below are a guide, not a complete list.

8. How Manna protects users#

• Keys are not held by Manna. Embedded wallet keys are held in Privy's secure infrastructure. Manna never sees or stores private keys. Exporting a key happens in Privy's own window, on Privy's domain.
• The one-tap signer can only sign. When you switch on one-tap trading or use the Telegram bot, Manna's signer is added to your wallets. It can sign the transactions you request, but it cannot take ownership of your wallet or export your keys. See One-tap trading and cash.
• Sign-in sessions use a single cookie signed with a server-side secret (HMAC), marked httpOnly, Secure in production and SameSite=Lax, and expiring after 30 days. Wallet sign-in uses a one-time nonce that expires after 15 minutes. See the Cookie and Storage Notice.
• API keys are stored only as a hash, are shown once, can carry a spend cap, and can be revoked at any time.
• Rate limits protect orders, bridges, alerts, uploads, the Telegram bot and other endpoints from abuse.
• Uploads are checked by their actual content, and only real image types are served, with restrictive headers.
• Automated jobs (such as the keeper and order execution) can only be triggered with a secret.
• The keeper's hot wallets are kept small. The keeper runs about every 15 minutes, so fee vaults hold only what has built up since the last run. On Robinhood Chain, the keeper can distribute vault balances to users and collect pool fees, but it cannot touch curve reserves, users' claimable balances or liquidity positions.
• Liquidity is locked. Manna's migrator contract has no function that removes liquidity from graduated pools, only fee collection.
• Token locks cannot be cancelled. The MannaLocker contract has no cancel, no admin withdrawal and no upgrades. Locked tokens can only go to the lock's owner, as they unlock. Its admin can only adjust lock fees within hard caps (0.05 ETH and 2%), which never affect existing locks.
• Contract ownership is limited. The owner of Manna's Robinhood Chain factory cannot touch curve reserves, fee vaults, users' claimable balances or liquidity positions. It can set configuration (such as listed pair assets, the treasury wallet and distributors) and withdraw the $MANNA buyback and holder reserves described in the Fee Schedule.

9. Protecting yourself#

• Manna will never ask for your private key, seed phrase or sign-in code, by email, Telegram, X or any other channel.
• Only use mannas.fun and the official bot linked from mannas.fun. Bookmark them.
• Secure your sign-in accounts (X, Google, Apple, Telegram, email) with strong passwords and two-factor authentication. Anyone who controls them may control your Manna account.
• If you export your keys, store them offline and never paste them into a website or chat.
• Check token addresses and chains before you trade or send.
• If you think your account is compromised, move your funds to a safe wallet and email hi@mannas.fun immediately.

10. Changes#

We may update this page, including scope and rewards. The version in effect when you submit a report applies to it.

Related#

• Security guide
• Contracts
• Privacy Policy
• Terms of Service