> For the complete documentation index, see [llms.txt](https://docs.superstate.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.superstate.com/investors/security.md).

# Security

***

## Overview

Superstate's highest priority is the protection of investor assets; [our funds](/investors/smart-contracts.md) have been designed holistically with security in mind. We work with world-class service providers, and have robust internal security policies designed to minimize operational risks.

The assets that back our funds are stored offchain with qualified custodians, and Superstate has overlapping, redundant records of ownership of our funds, including at our fund calculation agent, internally, and on-chain. In the unusual event in which an investor's Allowlist address is compromised, there are procedures in place capable of restoring your investment.\
\
Each core component of our platform has been audited, and safeguards have been put in place to protect all investor funds.

***

## Fund Custodians

<table><thead><tr><th width="243">Fund</th><th>Custodian</th></tr></thead><tbody><tr><td>USTB</td><td>The Bank of New York Mellon</td></tr><tr><td>USCC</td><td>Fund digital assets and cash are held at <a href="https://www.anchorage.com/">Anchorage Digital Bank N.A.</a>, with futures positions and margin maintained at the Trading Venues.</td></tr><tr><td>CUSHY</td><td>Coinbase Custody Trust Company, LLC and other qualified custodians</td></tr><tr><td>VBDC</td><td>Alpaca Securities LLC</td></tr></tbody></table>

For investors that purchase and redeem using USDC, cash and USDC are temporarily custodied at Circle or Erebor.

***

## Private Key Management

Facilitated by Turnkey. See their documentation [here](https://docs.turnkey.com/home).

***

## Bug Bounty Program

Superstate encourages the community to audit our contracts and security; we also encourage the responsible disclosure of any issues. This program is intended to recognize the value of working with the community of independent security researchers.

#### Rewards

Our Security team reviews every community submission and assesses each for a reward based on the severity and real-world impact of the vulnerability. We are grateful for all legitimate vulnerability discoveries and will acknowledge researchers after a fix has been widely deployed.

For critical vulnerabilities, such as those that compromise our smart contracts, infrastructure, or private key infrastructure, or that result in loss of funds, exposure of private keys or credentials, disclosure of user information, unauthorized state changes, domain takeover, or malicious redirection, we offer a minimum reward of $50,000. Lower severity vulnerabilities will be assessed on a case by case basis.

#### Disclosure

Submit all bug bounty disclosures to <security@superstate.co>. The disclosure must include clear and concise steps to reproduce the discovered vulnerability in either written or video format. We will follow up within 7 days with acknowledgement of the disclosure. Please review the disclosure before submission. Ensuring the report is well-written, easy to follow, and demonstrates real-world impact will greatly increase the likelihood of a reward.

#### What to Expect from Us

When working with us according to this policy, you can expect us to:

* Extend Safe Harbor protection for your vulnerability research related to this policy;
* Work with you to understand and validate your report, including providing a timely initial response to the submission;
* Work to remediate discovered vulnerabilities in a timely manner; and
* Recognize your contribution if you're the first to report a unique vulnerability that triggers a code or configuration change.

#### Scope

* This program covers Superstate’s smart contracts, superstate.co, and related Superstate-operated infrastructure. Third-party services and platforms are out of scope.

#### Ground Rules for Researchers

To encourage vulnerability research and to avoid any confusion between good-faith hacking and malicious attack, we ask that you:

* Follow this policy and any other relevant agreements.
* Report discovered vulnerabilities promptly.
* Avoid violating privacy, disrupting systems, destroying data, or harming user experience.
* For smart contract vulnerabilities, proofs of concept should be provided on a local fork or testnet. Do not test against or exploit live mainnet contracts.
* Use only specified reporting methods and official communication channels.
* Keep vulnerability details confidential until fixed.
* Limit data access when demonstrating a proof of concept, and immediately report any accidental access to sensitive data.
* Interact only with test accounts you own or have explicit permission to use.
* Do not engage in extortion.

#### Eligibility

Any payouts require identity verification and sanctions screening. All current and former employees, contractors, those in sanctioned jurisdictions, and paid third-party auditors of our systems are ineligible for rewards.

#### Safe Harbor

When conducting vulnerability research in full compliance with this policy and all applicable laws, we consider this research to be:

* Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
* Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
* Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
* Lawful, helpful to the overall security of the Internet, and conducted in good faith.

If you're unsure whether your research is consistent with this policy, please report through our official channels before proceeding.