Please do not file a public ticket mentioning the vulnerability.

We will work with researchers to coordinate vulnerability disclosure between our stakers, partners, and users to ensure the successful mitigation of vulnerabilities. Throughout the reporting process, we expect researchers to honor an embargo period that may vary depending on the severity of the disclosure. This ensures that we have the opportunity to fix any issues, identify further issues (if any), and inform our users.

Mezo runs a bug bounty program on Cantina: https://cantina.xyz/bounties/82d15510-9264-4ce0-9bee-ee0cb5c53742 . The MUSD smart contracts are in scope. Findings in scope for the bounty must be submitted through Cantina to be eligible for a reward; see the program page for scope, rules, and reward tiers.

Due to the vulnerability reporting volume in the age of LLM agents, vulnerabilities reported through security@mezo.org may be subject to no response unless they present a high-severity, highly exploitable, time sensitive issue. Other reports should flow through the Cantina bounty program.

For such issues, email security@mezo.org, following the guidelines at https://mezo.org/SECURITY.md . Encryption keys are listed at https://mezo.org/security.txt .

The Mezo team will make a best effort to respond to high-severity, highly exploitable, time sensitive reports within 24 hours. If a report is within the scope of the bounty program and does not meet the above criteria, a best effort will be made to notify the reporter that they should submit via the Cantina program.