01Authorization
No testing begins without a signed mandate naming the systems in scope, the permitted actions, the testing window, and an authorized signatory who warrants they may grant access to those systems. The mandate, not this page, defines the engagement. We do not act on verbal or emailed authorization alone.
02Scope
We test only what the mandate names. Deployed contracts, their dependencies as they exist on-chain, and the fork we build from them are in scope. Anything not listed — third-party front-ends, unrelated infrastructure, employees, physical premises — is out of scope and untouched.
03Value and funds
Exploits are demonstrated in a controlled mainnet fork. We move forked value to prove impact; no real user funds are moved, withheld, or put at risk in the course of testing. Any live keys or credentials encountered are reported immediately and never retained.
04Confidentiality
Everything we learn about your systems is confidential. Findings, scope, and your identity are shared only with people you designate, and are handled under the coordinated disclosure policy. We retain engagement records only as long as needed to support the work and any agreed re-test, then destroy them.
05Deliverables
You receive the findings, the reproductions, and remediation guidance. The report is yours. Our methods, tooling, and internal materials remain ours. We grant no warranty that a system is free of vulnerabilities beyond those reported within the tested scope and window.
06Limitation of liability
Testing carries inherent risk. Within the bounds permitted by law, our liability is limited to the fees paid for the engagement. We are not liable for losses arising from vulnerabilities outside the agreed scope, from your deployment decisions, or from actions taken by third parties.
07Use of this site
This site is informational. The research papers linked here are provided for study; the case studies are redacted and published with consent. Nothing on this site is a solicitation to attack any system you do not own or lack written authorization to test.
08Governing terms
Where these terms and a signed mandate differ, the mandate controls for that engagement. Questions → legal@mephistopheles.zip.