Vulnerability disclosure

Security

Found a bug in our contracts, writer or web app? Tell us before you tell anyone else and we will work with you in good faith.

Report

Email contact@hyperflip.xyz with steps to reproduce. Our machine-readable contact is at /.well-known/security.txt.

In scope

• ParlayVault and OutcomeVault contracts on HyperEVM testnet.
• The house writer API (quote signing, exposure caps, settlement pokes).
• hyperflip.xyz and app.hyperflip.xyz.

Rules

• Testnet only. Do not test against Hyperliquid mainnet.
• No denial of service, spam or social engineering of the team.
• Give us reasonable time to fix before public disclosure.

There is no paid bounty programme during beta. We credit reporters who want it.

Protect yourself

Check the official links page before connecting a wallet. We never DM first, never ask for a seed phrase and never ask you to “verify” a wallet outside the app.