Helix Finance
LiveSEAL Safe HarborOvercollateralized lending markets with isolated risk pools.
Rewards by severity
When you submit, the report is permanently bound to this version (fingerprint 5d8f90fe90…a0fd). Scope, impacts, rewards, SLAs and policies can't be changed for your report later, even if Helix Labs publishes a new version.
Assets in scope
4 assets
| ID | Asset | Type | Target |
|---|---|---|---|
| HLX-1 | Pool (proxy) | Smart contractEthereum | 0x4c1f2E7e…9A8b7C6d |
| HLX-2 | Liquidator | Smart contractEthereum | 0x8A9b0C1d…4E5f6A7b |
| HLX-3 | App Frontend only; no backend in scope. | Website / app | https://app.helix.example |
| HLX-4 | Pool (Arbitrum) | Smart contractArbitrum | 0x4c1f2E7e…9A8b7C6d |
Track record
Computed from case events. Projects can't edit these numbers.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates, even when they describe a different attack path, unless they demonstrate a materially higher impact.
Issues listed in published audits or recorded as known-issue commitments before the submission timestamp are ineligible. Commitments may be revealed during a dispute.
Public disclosure requires approval from both parties after the fix is deployed and verified. Default embargo: 30 days after fix.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision. The mediator publishes a reasoned decision to both parties.
Rewards are paid in USDC within the payout SLA after retest passes or after a Won't Fix decision. A Won't Fix decision never cancels an earned reward. The amount equals the locked reward calculation.
Adopted. During an active exploit, whitehats are pre-authorized to rescue funds under the SEAL agreement, for 10% of recovered assets up to $1,000,000. Adoption record: https://safeharbor.securityalliance.org