Security

Security

XOXNO Lending accepts private vulnerability reports covering the protocol and its supporting services. The repository security policy defines disclosure terms, scope, and response targets.

Report a vulnerability

Email security@xoxno.com. Encrypt sensitive details when possible; a PGP key is available on request. Do not publish suspected vulnerabilities in issues, pull requests, discussions, or social-media posts.

Include:

• The vulnerability and its practical impact.
• A minimal reproduction or proof of concept.
• The affected release or commit, with relevant files or entrypoints.
• The network, contract addresses, and environment needed to reproduce it.
• Observed and expected behavior, including any required assumptions.
• Whether any part of the issue is already public.

Do not access, modify, or disclose another person's data. Stop once there is enough evidence to demonstrate impact.

Response targets

Stage	Target
Acknowledgement	Within 2 business days
Initial triage	Within 5 business days
Updates while open	At least every 7 days
Coordinated disclosure	90 days from the report, unless otherwise agreed

Reporters may receive credit in release notes with their consent.

Scope and supported versions

In-scope reports cover the deployed lending protocol and supporting on-chain components, shared logic and public interfaces, keeper and exporter services, and deployment or configuration tooling that affects protocol behavior.

The policy excludes:

• Upstream dependencies and third-party oracle providers; report their vulnerabilities to their maintainers.
• Scenarios requiring a compromised governance, operational-role, or keeper key, unless the protocol materially worsens the compromise.
• Theoretical claims without reproducible security impact.
• Test-only contracts, unless the issue affects a production build or the test harness is itself in scope.

Security fixes target the latest tag on main. The support policy assigns that release to mainnet and permits release candidates on testnet. Include the network and contract addresses when reporting an issue whose deployment status is uncertain.

Safe harbor

XOXNO's policy provides that it does not pursue legal action against good-faith researchers who report privately, avoid disruption and data harm, prefer local or testnet environments for active testing, and limit exploitation to what is necessary to demonstrate the issue.

This policy does not authorize unlawful activity, testing against third-party systems, or actions that place user assets or data at risk. The security policy contains the full terms.

Security boundaries

Governance roles, code upgrades, token behavior, oracle sources, and external integrations are trust boundaries. The threat model describes their controls and remaining assumptions.

Governance and Timelock explains delayed administration and immediate emergency powers. Deployed owners, role holders, code, and effective delays require verification; repository configuration alone does not establish them. The swap aggregator and XOXNO oracle retain separate administration boundaries.

Required prices fail closed when their configured sources are unusable. When two sources are configured, both must pass the checks; one surviving source is not a fallback. Single-source configurations also exist. Price failure can block liquidation and other valuation-dependent actions. See Oracle System for pricing requirements and which actions avoid price reads.

Global pause does not disable every exit or recovery action. Listing flags, liquidity, and price availability impose separate restrictions, and interest continues while a listing is paused. Risk and Liquidations describes the relevant controls.