Tidal Bridge
LiveTrust-minimized cross-chain messaging and token bridge.
Proof-of-Concept requirements
- POC-1Critical and High reports must include a runnable PoC (Foundry or Hardhat) against a mainnet fork demonstrating the claimed impact end-to-end.
- POC-2The PoC must state the fork block number and must never be executed against mainnet or public testnets.
- POC-3Funds-at-risk claims must reference on-chain balances at the stated fork block.
Testing restrictions
Allowed: Local mainnet fork (Foundry/Anvil, Hardhat) · Project-provided staging deployment
- TEST-1Testing on mainnet or public testnet deployed code is prohibited; use local forks.
- TEST-2Testing against pricing oracles or third-party smart contracts is prohibited.
- TEST-3Phishing, social engineering and physical attacks are prohibited.
- TEST-4Denial-of-service attacks against project infrastructure are prohibited.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates, even when they describe a different attack path, unless they demonstrate a materially higher impact.
Issues listed in published audits or recorded as known-issue commitments before the submission timestamp are ineligible. Commitments may be revealed during a dispute.
Public disclosure requires approval from both parties after the fix is deployed and verified. Default embargo: 30 days after fix.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision. The mediator publishes a reasoned decision to both parties.
Rewards are paid in USDC within the payout SLA after retest passes or after a Won't Fix decision. A Won't Fix decision never cancels an earned reward. The amount equals the locked reward calculation.