Security
Overview
Superstate's highest priority is the protection of investor assets; USTB and USCC have been designed holistically with security in mind. We work with world-class service providers, and have robust internal security policies designed to minimize operational risks.
The assets that back our funds are stored offchain with qualified custodians, and Superstate has overlapping, redundant records of ownership of our funds, including at our fund calculation agent, internally, and on-chain. In the unusual event in which an investor's Allowlist address is compromised, there are procedures in place capable of restoring your investment. Each core component of our platform has been audited, and safeguards have been put in place to protect all investor funds.
Fund Custodians
USTB
USCC
Fund digital assets and cash are held at Anchorage Digital Bank N.A., with futures positions and margin maintained at the Trading Venues.
For investors that purchase and redeem using USDC, cash and USDC are temporarily custodied at Circle.
Private Key Management
Facilitated by Turnkey. See their documentation here.
Bug Bounty Program
Superstate encourages the community to audit our contracts and security; we also encourage the responsible disclosure of any issues. This program is intended to recognize the value of working with the community of independent security researchers.
Rewards
Superstate does not have a formal reward policy. Researchers should not expect compensation for discovering vulnerabilities. However, we are grateful for all legitimate vulnerability discoveries and will acknowledge researchers after a fix has been widely deployed.
Disclosure
Submit all bug bounty disclosures to [email protected]. The disclosure must include clear and concise steps to reproduce the discovered vulnerability in either written or video format. We will follow up promptly with acknowledgement of the disclosure.
What to Expect from Us
When working with us according to this policy, you can expect us to:
Extend Safe Harbor protection for your vulnerability research related to this policy;
Work with you to understand and validate your report, including providing a timely initial response to the submission;
Work to remediate discovered vulnerabilities in a timely manner; and
Recognize your contribution if you're the first to report a unique vulnerability that triggers a code or configuration change.
Ground Rules for Researchers
To encourage vulnerability research and to avoid any confusion between good-faith hacking and malicious attack, we ask that you:
Follow this policy and any other relevant agreements.
Report discovered vulnerabilities promptly.
Avoid violating privacy, disrupting systems, destroying data, or harming user experience.
Use only specified reporting method and official communication channels.
Keep vulnerability details confidential until fixed, as per the Disclosure Policy.
Test only in-scope systems and respect out-of-scope systems and activities.
Limit data access when demonstrating a Proof of Concept, and immediately report any accidental access to sensitive data.
Interact only with test accounts you own or have explicit permission to use.
Do not engage in extortion.
Safe Harbor
When conducting vulnerability research in full compliance with this policy and all applicable laws, we consider this research to be:
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
Lawful, helpful to the overall security of the Internet, and conducted in good faith.
If you're unsure whether your research is consistent with this policy, please report through our official channels before proceeding.
Last updated