Meridian DAO
LiveDisclosure programGovernance portal and treasury dashboard for the Meridian ecosystem.
Proof-of-Concept requirements
- POC-1Critical and High reports must include a runnable PoC demonstrating the claimed impact end-to-end.
- POC-2The PoC must state its environment (fork block, commit, build) and must never be executed against production.
Testing restrictions
Allowed: Staging environment provided on request
- TEST-1Testing against production systems or mainnet deployments is prohibited; use local forks or staging.
- TEST-2Phishing, social engineering and physical attacks are prohibited.
- TEST-3Denial-of-service attacks against project infrastructure are prohibited.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates unless they demonstrate a materially higher impact.
Issues in published audits or recorded as known-issue commitments before the submission timestamp are ineligible.
Public disclosure requires approval from both parties after the fix is deployed and verified.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision.
Recognition only: this program pays no monetary rewards. Valid findings receive a verified acknowledgement and credit on the researcher's Proofline profile.