> For the complete documentation index, see [llms.txt](https://docs.pots.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pots.money/pots-core/security.md).

# Security

### Introduction

Security is the highest priority of POTS Core. Crypto has a long and brutal history of exploits—billions of dollars lost to hacks, rug pulls, and protocol failures. We take this seriously.All POTS contract code and balances are publicly verifiable on-chain. Security researchers are eligible for substantial bug bounties for reporting undiscovered vulnerabilities.

{% hint style="success" %}
🛡️ Our Belief

Size, visibility, and time are the true tests of a smart contract's security. We invite every community member to review our code, challenge our assumptions, and help us build a more resilient protocol.
{% endhint %}

### Our Security Principles

Every design decision in POTS is guided by four core security principles:

<table data-header-hidden><thead><tr><th width="192.94140625"></th><th></th></tr></thead><tbody><tr><td>Principle</td><td>What It Means</td></tr><tr><td>Business Integrity</td><td>Protocol logic is designed to be complete and consistent. No edge case should compromise user funds.</td></tr><tr><td>Code Standardization</td><td>We follow industry-standard coding practices and undergo rigorous peer review before any deployment.</td></tr><tr><td>Logical Simplicity</td><td>Complex systems fail in complex ways. We keep contract logic as simple as possible to minimize attack surface.</td></tr><tr><td>Decentralization</td><td>No single point of failure. Distributed architecture ensures that no single actor can compromise the protocol.</td></tr></tbody></table>

### Audit Reports

POTS has been audited by leading blockchain security firms. All audit reports are publicly available.

**CertiK**

One of the world's most recognized blockchain security firms. CertiK has audited over 4,000 projects and secured over $360 billion in on-chain assets.

* [POTSMoney Security Monitor](https://skynet.certik.com/zh-CN/projects/pots-money) — by CertiK Skynet
* [$IBS Smart Contracts](https://skynet.certik.com/zh-CN/projects/pots-money) — Audit Report by CertiK

**Bitlabs**

A specialist blockchain security firm focused on DeFi protocol auditing and formal verification.

* [IBS-POTS-Contact Audit Repoert Smart Contracts](http://scalebit.xyz/reports/IBS-POTS-CONTRACT-Audit-Report-5-1-2026.pdf) — Audit Report by Bitlabs

{% hint style="success" %}
More audits are on the way.We are committed to engaging additional security partners as the protocol evolves. All future audit reports will be published here.
{% endhint %}

### Bug Bounty Programs

POTS values the work of white hat hackers and independent security researchers. We have established two active bug bounty programs to incentivize responsible disclosure.

**CertiK Skynet Bug Bounty**

Reward Pool: $1,000,000 USDPowered by CertiK Skynet's real-time security monitoring. This program covers all critical vulnerabilities in POTS smart contracts and infrastructure.

[View on CertiK Skynet →](https://skynet.certik.com/zh-CN/projects/pots-money)

{% hint style="success" %}
💰 More bounties are being added.

As POTS expands, additional bounty programs will be launched. Stay tuned for updates.
{% endhint %}

### Scope of Bug Bounty Programs

Both programs apply to POTS smart contracts and applications, and are focused on preventing:

* Theft or freezing of user principal of any amount
* Theft or freezing of unclaimed yield of any amount
* Theft of governance funds
* Disruption of governance activity
* Unauthorized access to sensitive pages or data
* User data leaks or deletion

### Responsible Disclosure

To report a vulnerability, please submit your disclosure to:

[<mark style="color:blue;">contact@pots.money</mark>](/pots.money/ibs-the-future-money.md)

Your report must include clear and concise steps to reproduce the vulnerability, in written or video format. The POTS security team will acknowledge your submission promptly and work with you in good faith to resolve the issue.

{% hint style="danger" %}
Please do not disclose vulnerabilities publicly before they have been resolved. Responsible disclosure protects users and ensures you receive the full bounty reward.
{% endhint %}