USDAX Finance is currently deployed on Robinhood Chain Testnet. The protocol is in pre-mainnet phase and has not yet undergone a formal external security audit. Do not use with real funds on mainnet.

Do not open a public GitHub issue for security vulnerabilities.

Report security issues privately to: support@usdax.finance

Please include:

• A clear description of the vulnerability
• Steps to reproduce or proof-of-concept code
• Affected contract, endpoint, or component
• Estimated impact (funds at risk, data exposure, etc.)
• Any suggested mitigations

We will acknowledge receipt within 48 hours and provide a remediation timeline within 5 business days.

In scope:

• Smart contracts: VaultEngine, USDAxToken, CollateralManager, MockPriceOracle, USDAxSavings
• API server: route logic, data integrity, input validation
• Frontend: wallet interaction, transaction construction

Out of scope:

• Third-party dependencies and their upstream vulnerabilities
• Robinhood Chain node infrastructure
• Issues in test environments that cannot be reproduced on the deployed testnet contracts

We follow coordinated disclosure. Please allow reasonable time for a fix to be developed and deployed before publishing details publicly.