Skip to main content

Responsible Disclosure

Vessel is unaudited, experimental software on Monad testnet. If you find a vulnerability, the team wants the report. This page tells you how to send one, starting with what is missing.

The gap​

As of 2026-08-29, Vessel publishes no dedicated security contact: no security mailbox, no security.txt at /.well-known/security.txt, and no disclosure policy. The public repository contains only a README and a LICENSE — no SECURITY.md. Where the contact belongs on a page like this, there is a gap:

Security contact: none published as of 2026-08-29 UNVERIFIED — PENDING GATE-0

That is a real deficiency, and this page records it rather than dressing it up.

Reporting today​

Until a dedicated channel exists, reach the team through the channels that do exist: X (x.com/vessel_hq) or Telegram (t.me/+Akd24ACXWl5lY2E1). Say you have a security report and ask for a private channel. Do not put the details in a public post or a group chat.

The team has committed to treating messages that arrive this way as security reports. That routing is a team statement, not a published policy; the difference matters, and closing it is a Gate-0 item below.

What a useful report includes​

  • Network. Vessel runs on Monad testnet today; its chain ID is 10143.
  • Address. The contract you interacted with. Vessel's addresses are not yet published, so copy the address the app shows you.
  • Transaction hash. So the team can inspect the exact state involved on testnet.monadscan.com.
  • Reproduction. Exact steps or a script. A failing test is ideal.
  • Impact. What an attacker gains, who loses, and roughly how much.

Committed at Gate-0​

Gate-0 adds the infrastructure this page currently lacks:

  • a dedicated disclosure contact,
  • security.txt served at /.well-known/security.txt,
  • a published disclosure policy.

When those ship, the gap above closes and this page becomes a pointer to the policy.

Safe harbor​

A commitment, stated plainly: good-faith security research on Vessel will not be met with legal threats. Probe the testnet contracts, find something, and report it through the channels above — the response is a fix and a thank-you, not a lawyer. This is stated intent from the team today; the Gate-0 policy will put it in formal terms.

Verified from: vessel.wtf · vessel-repo · vessel-team-brief · docs.monad.xyz — Sat Aug 29 2026 00:00:00 GMT+0000 (Coordinated Universal Time) · How we verify this site →