[Proposal] - Adopt The SEAL Safe Harbor Agreement

Proposals
1

[Proposal] - Adopt The SEAL Safe Harbor Agreement

Category: Proposals
Authors: samczsun (SEAL), dickson (SEAL), weeb (Cove)

Introduction

This proposal outlines Cove’s adoption of the SEAL (Security Alliance) Whitehat Safe Harbor Agreement (“Safe Harbor Agreement”). By adopting Safe Harbor, Cove improves the security of its on-chain assets by allowing whitehats to intervene during active exploits to save protocol funds.

What is the Safe Harbor Agreement?

The Safe Harbor Agreement addresses a critical need in crypto: enabling whitehats to intervene during active exploits when traditional responsible disclosure procedures are not feasible.

Key aspects of the agreement include:

  • Encouraging Whitehats to Protect the Protocol: By adopting Safe Harbor, Cove incentivizes whitehats to step in and protect the protocol during active exploits by limiting their legal exposure.

  • Intervention Only During Active Exploits: Whitehats are authorized to act only when there is an immediate or ongoing exploit that threatens the protocol. This agreement applies only to critical situations where responsible disclosure procedures would not save funds due to the urgency of the exploit, and it is not intended for routine security testing or vulnerability reporting.

  • Mandatory Return of Rescued Funds: Under the terms of the Safe Harbor, whitehats are required to return all rescued assets to a pre-designated recovery address controlled by the protocol within 72 hours of recovering them. This ensures that recovered funds are quickly secured, preventing delay or potential loss.

  • Clear Guidelines and Legal Protection: The agreement establishes strict rules for how whitehats must operate during an exploit, ensuring recovery efforts are conducted professionally and safely, minimizing the risk of mistakes or further damage to the protocol. By adhering to these guidelines, whitehats can limit their potential legal exposure, allowing them to act in good faith without fear of liability.

  • Incentivized Rescue Efforts: To motivate whitehats to act during critical situations, the agreement offers a bounty system similar to a bug bounty. Whitehats are rewarded with a percentage of the recovered assets, up to a predefined cap, for their successful interventions.

Rationale

Cove is committed to enhancing its security and protecting user funds during critical moments. While security audits and other preventive measures are crucial, the unpredictable nature of exploits requires a swift, decisive response mechanism to minimize potential damage.

The Safe Harbor Agreement empowers whitehats to act immediately during an active exploit, providing a proactive and structured recovery process. By enabling whitehats to step in and recover assets during a crisis, Cove strengthens its defenses against emerging threats.

Benefits of adopting the Safe Harbor Agreement include:

  • Agile Defense Against Exploits: Whitehats are authorized to intervene as soon as an active exploit is detected, enabling them to respond faster than traditional methods. This ensures that Cove is protected against threats even without the ability to halt the protocol. Immediate action minimizes the window for malicious actors, reduces damages, and accelerates the recovery of assets during critical moments.

  • Clarified Rescue Process: The agreement ensures that every step, from intervention to fund recovery, is predetermined and streamlined. Whitehats know exactly where to send recovered funds, preventing chaotic negotiations or rushed decisions during an exploit. This clarity ensures efficient, decisive action when it matters most.

  • Clear Financial Boundaries: The predefined bounty system, with a cap matching Cove’s existing bug bounty, ensures that whitehats are incentivized fairly without creating conflicting priorities between exploit intervention and standard vulnerability disclosure. By setting expectations upfront, it eliminates post-exploit negotiations, ensuring funds are returned promptly without attempts to change the reward amount, keeping the process fair and transparent.

  • Aligning with Industry Best Practices: By adopting the Safe Harbor Agreement, Cove aligns itself with leading security practices across the industry, reinforcing its commitment to staying at the forefront of protocol security.

Adoption of the agreement complements audits by providing an additional layer of security, ensuring that the protocol is better prepared to respond to active threats.

Adoption Details

Cove will adopt the agreement with the following parameters. For more information review the Safe Harbor Scope document.

  1. Asset Recovery Address: Addresses controlled by Cove, which recovered funds will be returned to in the event of a hack.
Chain Address
1- Ethereum Mainnet 0x7Bd578354b0B2f02E656f1bDC0e41a80f860534b
  1. Scope: List of all on-chain assets protected under Safe Harbor
Chain Name Address Type (None, Existing Only, All)
1- Ethereum Mainnet Cove 0x32fb7D6E0cBEb9433772689aA4647828Cc7cbBA8 None
1- Ethereum Mainnet Basket Manager 0x716c39658Ba56Ce34bdeCDC1426e8768E61912f8 All
1- Ethereum Mainnet CoveYFI 0xFf71841EeFca78a64421db28060855036765c248 None
1- Ethereum Mainnet Cove Yearn Gauge Factory 0x842b22Eb2A1C1c54344eDdbE6959F787c2d15844 All
1- Ethereum Mainnet Wrapped YearnV3 Strategy (ysyG-yvUSDS-1) 0x81f78DeF7a3a8B0F6aABa69925efC69E70239D95 None
1- Ethereum Mainnet BasketToken (coveUSD) 0xEeA3Edc017877C603E2F332FC1828a46432cdF96 None
  • “All”: The Safe Harbor Agreement will cover both the subcontracts currently deployed under this contract and any future subcontracts deployed through it. This ensures that all present and future subcontracts are protected.

  1. Contact Details: Designated security contact for Cove

    • Name: Sunil Srivatsa

    • Contact Information: sunil@storm-labs.xyz

  2. Bounty Terms: Predetermined rewards for successful whitehats that protect protocol funds

    • Bounty Percentage: 10% of recovered funds.

    • Bounty Cap (USD): $50,000

    • Aggregate Bounty Cap (USD): $50,000

  • Retainable: False

    1. This means that whitehats cannot retain their bounty directly from the recovered assets. Instead, all rescued funds must be returned to the protocol’s designated asset recovery address, and the bounty will be paid out separately after verification.

  • Identity Verification: Named

    1. Whitehats must provide their full legal name. This requirement ensures compliance with legal obligations and is similar to the identity verification standards seen in traditional bug bounty programs.

  • Diligence Requirements: KYC and OFAC Screening

    1. Cove requires all eligible whitehats to undergo Know Your Customer (KYC) verification and be screened against the Office of Foreign Assets Control (OFAC) sanctions lists. This process ensures that all bounty recipients are compliant with legal and regulatory standards before qualifying for payment.

Implementation Plan

  1. Register Agreement On-Chain:

    • The agreement will be registered on Ethereum in the Safe Harbor Registry at address 0x1eaCD100B0546E433fbf4d773109cAD482c34686, including all adoptionDetails. This ensures transparency and immutability.

  2. Communicate Adoption:

    • An official announcement will be made across all Cove communication channels, explaining the adoption and its significance to the community.

  3. Future Updates to Scope:

    • New versions of Cove will be reviewed and added to the Safe Harbor Agreement scope via Cove Governance vote, ensuring continued protection for all new contracts and functionalities.

Conclusion

Adopting the SEAL Whitehat Safe Harbor Agreement equips Cove with a rapid response mechanism for active exploits, enabling whitehats to step in effectively when needed most. The agreement provides clear guidelines for action, increasing the protection of user funds and demonstrating Cove’s commitment to proactive security.

References

  • SEAL Whitehat Safe Harbor Agreement Documentation: Framework

  • SEAL Whitehat Safe Harbor Agreement Legal Agreement: Link

Please share your thoughts and feedback in the discussion below before the proposal moves to a formal vote.

2 Likes