Security Policy

Supported Versions

Component	Version	Supported
`LazarusProtocol/contracts`	`0.1.x` (Stellar Testnet)	✅
`LazarusProtocol/attestation`	`0.1.x`	✅
`LazarusProtocol/indexer`	`0.1.x`	✅
`LazarusProtocol/keeper`	`0.1.x`	✅
`LazarusProtocol/web`	`0.1.x`	✅

We take the security of the Lazarus Protocol (smart contracts, 2-of-3 FROST MPC attestation enclave, indexer, and keeper infrastructure) seriously.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Every repository in the LazarusProtocol organization has GitHub Private Vulnerability Reporting enabled:

Navigate to the relevant repository (e.g., LazarusProtocol/contracts).
Click the Security tab -> Report a vulnerability.
Submit your report with reproduction steps, affected files/lines, and impact analysis.

Atomic Vault Initialization (CAP-0058): LazarusVault uses Soroban's __constructor (CreateContractWithCtorHostFunction) alongside admin.require_auth() in initialize so contract creation and initialization occur atomically in a single transaction.
Decoupled Voucher Verification: In Soroban (CAP-0053 / CAP-0066), ExtendFootprintTTLOp is a host-level operation and soroban-env-host does not expose cross-contract storage TTL introspection on-chain. LazarusVault::process_voucher therefore verifies domain-separated LAZARUS_VOUCHER_V1 XDR payloads signed by the 2-of-3 FROST Attestation Oracle (ed25519_verify), which inspects closed ledger metadata (LedgerCloseMeta) off-chain before issuing a signature.