Security

SECURITY.md

Security

Before you push

Do not commit contracts/.env, .env, or frontend/.env.local
Only commit .env.example files
Rotate API keys if they were shared anywhere public

Trust model

Portfolio / testnet project. Know what the owner can do:

Risk	Detail
Owner minting	Unlimited FORGE and FOG supply
Reward rate	Owner can change emission anytime
Reward funding	Owner must fund FOG for claims to work

Not mainnet-ready without audit, timelock, or multisig.

Protections in the contracts

ReentrancyGuard on stake, withdraw, claim
SafeERC20 for transfers
Zero address and zero amount checks
24 Hardhat tests

Reporting

Open a GitHub security advisory or contact the maintainer directly.

There aren't any published security advisories