Skip to main content
If you find a vulnerability in one of our contracts or services, we want to hear about it. This page sets out what is in scope, how to report it, and what we commit to in return. It covers nexroute, Hades Builder and Van Helsing.

​
Scope

  • Our smart contracts, including the nexroute routers, our backrun contracts and Van Helsing’s contracts (github.com/nexroute/van-helsing)
  • Our APIs and RPC endpoints
  • nexroute.io, hades.build and their subdomains
  • Hades Builder

​
Out of scope

  • Contracts we do not operate: DEX pools, Permit2, and integrators’ wrappers and routers
  • Denial-of-service tests
  • Social engineering and spam

​
How to report

Email security@nexroute.io with:
  • the contract or service affected
  • the steps to reproduce
  • the impact you expect

​
What we commit to

  • We acknowledge your report and give you a first assessment within one business day.
  • We keep you informed until the fix is live.
  • We credit you, if you wish.

​
Coordinated disclosure

Please do not publish until the fix is live or 30 days have passed, whichever comes first.

​
Safe harbour

We will not take legal action against research done in good faith under this policy:
  • no access to other people’s data or funds beyond what is needed to show the issue
  • no harm to users or to the services
  • a prompt report
  • confidentiality until the fix is live

​
Rewards

We do not run a formal bug bounty programme, but we may reward valid reports at our discretion.

​
Contracts that cannot be patched

Our routers are immutable, so a fix is a new router at a new address. We tell the integrators concerned directly, so they can move to it.