Expected scope when it opens:
src/core, src/oracles, src/governance, src/periphery, src/token. Out of scope: src/testnet, third-party tokens, Pons STK, Chainlink feeds.
Email security@mystockline.xyz. Include a PoC against the tagged contracts, the network, and the impact. Do not open a public GitHub issue for a live fund-risk bug.
What to reason about today: action table vs EquityOracle.regime(), liquidation sizing and the unenforced allowlist flag, FeeCollector waterfall and buy-and-burn bounds, Zap and PositionRouter zero-balance invariant, Guardian cannot pause repay or supplyCollateral.
Related: Access controls, Risks, Governance.
The core has no admin functions and no proxies. Parameter writes go through owner, which should be the timelock. Guardian is a pause key on Stockline only. Access controls lists every privileged function the scanner found.
Until audits land, treat every integration as pre-audit. Caps, the allowlist flag (unenforced), and thin exit depth are the live risk controls. See Risks.
Disclosure contact is the only channel for fund-risk bugs. The bounty table stays closed until rewards are published.