Core locks — highest priority
LockVaultV4 proxy · 0x5221A10B772D5e2d51B60E8e3dd5DA9338b04ab0
PinkLockAdapterV4 proxy · 0xA2898528eb4Aea0bDAf47202A5BA3bA4f58F831c
Upgrade multisig · 0xCb847B572352156be50c90FBc752cfd032114666
Delayed proxy admin · 0xDB998916A34b87c7DA337d922bC1219970FA0319
LockVaultV3 · 0xd4064d8E73AAB53D7d9efd8A6E8DBE2003d1de4B
PinkLockAdapterV3 · 0x6022DA059FAa0673E3058ADECEef375c2Abfb4A1
LockVaultV2 · 0xbC511F31967D9EBF775d203661a2BEfF6AA42615
PinkLockAdapterV2 · 0xDBE1f3dc1d6E6759355E1B164231748f0589cb41
LockVault (v1, legacy) · 0xe410d0a21C1376992874a9bEEeE0d623A50D4a34
PositionLock · 0xfC9A43c90e0E0d548D95cEf3C77fce802806CbA9
PinkLockAdapter (v1, legacy) · 0x16e02A106fE6E978fB98F76756B3a06b4995a7A6
Tools and launch path
OakenLauncherV3 · 0x4488C369116D0C6FEA84162313c3840976D5A9a5
OakenLauncherV2 · 0x0d7cCEA7BabC5e3b4849267740D8fBBe6C4FDa58
OakenLauncher (v1, legacy) · 0x1d7561fC331594820382E8dd64582645EbafD873
TokenFactory · 0xc0A3AD1428EeB70cAF88bb89c3B17D0191E1Bd34
MultiSender · 0x1f380ef5eFF9113314Ee175dCE4F226DFd75A50C
OakenAirdrop · 0x17E9910cDC37BdA5531414012aeA5b0862C22066
PresaleFactory · 0xAC070cf2ed45aEcb9f5299d4C670fFfCE6387724
All addresses are the same on Robinhood Chain (4663), BNB Chain (56), Base (8453) and Polygon (137). Source is intended to be verified byte-for-byte on Sourcify; verification is not an audit.
Different trust boundary
Bonds (OAKEN/aOAKEN) have a 2-of-3 Safe, a Timelock and a NAV keeper; they are a separate product with a separate scope. The HD Protocol `.hood` registry, third-party launchpads (Pons, Genius, Flap, Clanker, four.meme) and Jupiter Lock are third-party contracts and are not ours to fix.
Not a contract bug
Frontend-only issues, copy, SEO, gas optimisation suggestions, spam/DoS against public RPCs, and reports that require compromising a user’s wallet or a third-party service are out of scope for this page. If a frontend issue can move funds or sign the wrong transaction, report it anyway — it is still useful.
| Severity | What it means here | Reward |
|---|---|---|
| Critical | Loss or permanent lock of user funds in an in-scope contract; unauthorized movement of locked tokens. | Not set |
| High | Bypass of the beneficiary/creator rules, incorrect release amounts, or a reachable denial of claims for many locks. | Not set |
| Medium | Griefing or incorrect state that does not directly move funds; a single lock affected with a realistic path. | Not set |
| Low | Best-practice, informational or UI/UX issues without a fund path. | Not set |
Send it privately
Direct message @oakenhood on X. Include the chain, contract address, function, a minimal reproduction, the expected/actual result, and whether funds are at risk. If you prefer, put the report in a private gist and send the link.
Private report on GitHub Message @oakenhood
GitHub private vulnerability reporting is live; only the maintainers see it. A paid bounty is still not live.
Rules
Do not exploit beyond what is needed to demonstrate the issue. Do not access other users’ data or wallets. Do not run denial-of-service tests. Give us reasonable time to reproduce and fix before public disclosure. Reports must be original and not already known.