# \[IIP-43\] - Adopt The SEAL Safe Harbor Agreement **URL:** \ **Category:** ⛓ IIPs\ **Created:** [July 23, 2025, 9:37pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323 "2025-07-23T21:37:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![samczsun](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/samczsun/32/1274_2.png) [@samczsun](https://gov.pareto.credit/u/samczsun)\ **Post date:** [July 23, 2025, 9:37pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/1 "2025-07-23T21:37:30Z")
# **[IIP-43] - Adopt The SEAL Safe Harbor Agreement** **Category** :Proposals **Authors** : samczsun (SEAL), dickson (SEAL), @william (Pareto) * * * ## **Introduction** This proposal outlines Pareto’s adoption of the Security Alliance (SEAL) Whitehat Safe Harbor Agreement (“Safe Harbor Agreement”). By adopting Safe Harbor, Pareto improves the security of its on-chain assets by allowing whitehats to intervene during active exploits to save protocol funds. ### **What is the Safe Harbor Agreement?** The Safe Harbor Agreement addresses a critical need in crypto: enabling whitehats to intervene during active exploits when traditional responsible disclosure procedures are not feasible. Key aspects of the agreement include: - **Encouraging Whitehats to Protect the Protocol:** By adopting Safe Harbor, Pareto incentivizes whitehats to step in and protect the protocol during active exploits by limiting their legal exposure. - **Intervention Only During Active Exploits:** Whitehats are authorized to act only when there is an immediate or ongoing exploit that threatens the protocol. This agreement applies only to critical situations where responsible disclosure procedures would not save funds due to the urgency of the exploit, and it is not intended for routine security testing or vulnerability reporting. - **Mandatory Return of Rescued Funds:** Under the terms of the Safe Harbor, whitehats are required to return all rescued assets to a pre-designated recovery address controlled by the protocol within 72 hours of recovering them. This ensures that recovered funds are quickly secured, preventing delay or potential loss. - **Clear Guidelines and Legal Protection:** The agreement establishes strict rules for how whitehats must operate during an exploit, ensuring recovery efforts are conducted professionally and safely, minimizing the risk of mistakes or further damage to the protocol. By adhering to these guidelines, whitehats can limit their potential legal exposure, allowing them to act in good faith without fear of liability. - **Incentivized Rescue Efforts:** To motivate whitehats to act during critical situations, the agreement offers a bounty system similar to a bug bounty. Whitehats are rewarded with a percentage of the recovered assets, up to a predefined cap, for their successful interventions. * * * ## **Rationale** Pareto is committed to enhancing its security and protecting user funds during critical moments. While security audits and other preventive measures are crucial, the unpredictable nature of exploits requires a swift, decisive response mechanism to minimize potential damage. The Safe Harbor Agreement empowers whitehats to act immediately during an active exploit, providing a proactive and structured recovery process. By enabling whitehats to step in and recover assets during a crisis, Pareto strengthens its defenses against emerging threats. Benefits of adopting the Safe Harbor Agreement include: - **Agile Defense Against Exploits:** Whitehats are authorized to intervene as soon as an active exploit is detected, enabling them to respond faster than traditional methods. This ensures that Pareto is protected against threats even without the ability to halt the protocol. Immediate action minimizes the window for malicious actors, reduces damages, and accelerates the recovery of assets during critical moments. - **Clarified Rescue Process:** The agreement ensures that every step, from intervention to fund recovery, is predetermined and streamlined. Whitehats know exactly where to send recovered funds, preventing chaotic negotiations or rushed decisions during an exploit. This clarity ensures efficient, decisive action when it matters most. - **Clear Financial Boundaries:** The predefined bounty system, with a cap matching Pareto’s existing bug bounty, ensures that whitehats are incentivized fairly without creating conflicting priorities between exploit intervention and standard vulnerability disclosure. By setting expectations upfront, it eliminates post-exploit negotiations, ensuring funds are returned promptly without attempts to change the reward amount, keeping the process fair and transparent. - **Aligning with Industry Best Practices:** By adopting the Safe Harbor Agreement, Pareto aligns itself with leading security practices across the industry, reinforcing its commitment to staying at the forefront of protocol security. Adoption of the agreement complements audits by providing an additional layer of security, ensuring that the protocol is better prepared to respond to active threats. * * * ## **Adoption Details** Pareto will adopt the agreement with the following parameters. 1. **Asset Recovery Address: Addresses controlled by Pareto, which recovered funds will be returned to in the event of a hack.** | | | | --- | --- | | **Chain** | **Address** | | Ethereum | 0xfb3bd022d5dacf95ee28a6b07825d4ff9c5b3814 | | Optimism | 0xFDbB4d606C199F091143BD604C85c191a526fbd0 | | Arbitrum | 0xf40d482d7fc94c30b256dc7e722033bae68ecf90 | | Polygon | 0x61A944Ca131Ab78B23c8449e0A2eF935981D5cF6 | 1. **Scope: List of all on-chain assets protected under Safe Harbor** | Chain | Name | Address | Type (None, Existing Only, All) | | --- | --- | --- | --- | | Ethereum | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Optimism | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Arbitrum | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Polygon | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | - “All”: The Safe Harbor Agreement will cover both the subcontracts currently deployed under this contract and any future subcontracts deployed through it. This ensures that all present and future subcontracts are protected. - In this case, all contracts deployed by the Pareto Deployer EOA would be under scope 1. **Contact Details: Designated security contact for Pareto** 2. **Bounty Terms: Predetermined rewards for successful whitehats that protect protocol funds** * * * ## **Implementation Plan** 1. **Register Agreement On-Chain** : 2. **Communicate Adoption** : 3. **Future Updates to Scope:** * * * ## **Conclusion** Adopting the SEAL Whitehat Safe Harbor Agreement equips Pareto with a rapid response mechanism for active exploits, enabling whitehats to step in effectively when needed most. The agreement provides clear guidelines for action, increasing the protection of user funds and demonstrating Pareto’s commitment to proactive security. * * * ## **References** - **SEAL Whitehat Safe Harbor Agreement** :[](https://github.com/security-alliance/safe-harbor)https://github.com/security-alliance/safe-harbor - **Pareto Bug Bounty** : [Immunefi Bug Bounty](https://immunefi.com/bug-bounty/pareto/information/) * * * _Please share your thoughts and feedback in the discussion below before the proposal moves to a formal vote._ ---
**Author:** ![Dickson](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Dickson](https://gov.pareto.credit/u/Dickson)\ **Post date:** [July 23, 2025, 9:43pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/2 "2025-07-23T21:43:54Z")
Hey everyone - I’m Dickson one of the leads of Safe Harbor! Feel free to comment and let us know if you have any questions! Always happy to talk about Safe Harbor! ---
**Author:** ![william](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/william/32/10_2.png) [@william](https://gov.pareto.credit/u/william)\ **Post date:** [July 24, 2025, 7:55am UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/3 "2025-07-24T07:55:44Z")
Thanks for posting this @samczsun and thanks for the support @Dickson. Giving legal protection and economic clarity to whitehats is paramount, this agreement will allow them to act quickly to limit or prevent losses. With Idle and now Pareto we always focused on security and the adoption of the SEAL Safe Harbor agreement can potentially be the extra layer of protection we need when it matters most. I’m ofc in favor of this proposal and if no specific concerns are raised in the next 24 hours we will proceede to create a vote on snapshot. ---
**Author:** ![Biaf](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/biaf/32/213_2.png) [@Biaf](https://gov.pareto.credit/u/Biaf)\ **Post date:** [July 24, 2025, 9:02am UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/4 "2025-07-24T09:02:19Z")
I’m in favor of the proposal, thanks for posting it, @samczsun. Security has always been a top priority for Idle/Pareto, and adopting the SEAL Safe Harbor Agreement would further strengthen the protocol’s defenses in the event of an attack. That said, it looks like there may be a typo in the bounty terms. The cap appears to be set at $50, while it likely should be $50,000: > [@samczsun](#): > > **Bounty Terms: Predetermined rewards for successful whitehats that protect protocol funds** > > - **Bounty Percentage: 10** % of recovered funds. > - **Bounty Cap (USD)**: $50.000 > - **Aggregate Bounty Cap (USD):** $50.000 > - **Retainable:** True If approved, I believe it would be valuable to add this to the security section of our the documentation. > **[Security | Pareto Docs](https://docs.pareto.credit/developers/security)** ---
**Author:** ![Dickson](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Dickson](https://gov.pareto.credit/u/Dickson)\ **Post date:** [July 24, 2025, 4:43pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/5 "2025-07-24T16:43:28Z")
Nice to meet you Biaf! Thanks for catching the typo - let me fix it up! Yes for sure would love it Pareto could add it to their documentation! ---
**Author:** ![Dickson](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Dickson](https://gov.pareto.credit/u/Dickson)\ **Post date:** [July 24, 2025, 4:44pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/6 "2025-07-24T16:44:06Z")
**UPDATED PROPOSAL** # **[IIP-43] - Adopt The SEAL Safe Harbor Agreement** **Category** :Proposals **Authors** : samczsun (SEAL), dickson (SEAL), @william (Pareto) * * * ## **Introduction** This proposal outlines Pareto’s adoption of the SEAL ([Security Alliance](https://www.securityalliance.org/)) Whitehat Safe Harbor Agreement (“Safe Harbor Agreement”). By adopting Safe Harbor, Pareto improves the security of its on-chain assets by allowing whitehats to intervene during active exploits to save protocol funds. ### **What is the Safe Harbor Agreement?** The Safe Harbor Agreement addresses a critical need in crypto: enabling whitehats to intervene during active exploits when traditional responsible disclosure procedures are not feasible. Key aspects of the agreement include: - **Encouraging Whitehats to Protect the Protocol:** By adopting Safe Harbor, Pareto incentivizes whitehats to step in and protect the protocol during active exploits by limiting their legal exposure. - **Intervention Only During Active Exploits:** Whitehats are authorized to act only when there is an immediate or ongoing exploit that threatens the protocol. This agreement applies only to critical situations where responsible disclosure procedures would not save funds due to the urgency of the exploit, and it is not intended for routine security testing or vulnerability reporting. - **Mandatory Return of Rescued Funds:** Under the terms of the Safe Harbor, whitehats are required to return all rescued assets to a pre-designated recovery address controlled by the protocol within 72 hours of recovering them. This ensures that recovered funds are quickly secured, preventing delay or potential loss. - **Clear Guidelines and Legal Protection:** The agreement establishes strict rules for how whitehats must operate during an exploit, ensuring recovery efforts are conducted professionally and safely, minimizing the risk of mistakes or further damage to the protocol. By adhering to these guidelines, whitehats can limit their potential legal exposure, allowing them to act in good faith without fear of liability. - **Incentivized Rescue Efforts:** To motivate whitehats to act during critical situations, the agreement offers a bounty system similar to a bug bounty. Whitehats are rewarded with a percentage of the recovered assets, up to a predefined cap, for their successful interventions. * * * ## **Rationale** Pareto is committed to enhancing its security and protecting user funds during critical moments. While security audits and other preventive measures are crucial, the unpredictable nature of exploits requires a swift, decisive response mechanism to minimize potential damage. The Safe Harbor Agreement empowers whitehats to act immediately during an active exploit, providing a proactive and structured recovery process. By enabling whitehats to step in and recover assets during a crisis, Pareto strengthens its defenses against emerging threats. Benefits of adopting the Safe Harbor Agreement include: - **Agile Defense Against Exploits:** Whitehats are authorized to intervene as soon as an active exploit is detected, enabling them to respond faster than traditional methods. This ensures that Pareto is protected against threats even without the ability to halt the protocol. Immediate action minimizes the window for malicious actors, reduces damages, and accelerates the recovery of assets during critical moments. - **Clarified Rescue Process:** The agreement ensures that every step, from intervention to fund recovery, is predetermined and streamlined. Whitehats know exactly where to send recovered funds, preventing chaotic negotiations or rushed decisions during an exploit. This clarity ensures efficient, decisive action when it matters most. - **Clear Financial Boundaries:** The predefined bounty system, with a cap matching Pareto’s existing bug bounty, ensures that whitehats are incentivized fairly without creating conflicting priorities between exploit intervention and standard vulnerability disclosure. By setting expectations upfront, it eliminates post-exploit negotiations, ensuring funds are returned promptly without attempts to change the reward amount, keeping the process fair and transparent. - **Aligning with Industry Best Practices:** By adopting the Safe Harbor Agreement, Pareto aligns itself with leading security practices across the industry, reinforcing its commitment to staying at the forefront of protocol security. Adoption of the agreement complements audits by providing an additional layer of security, ensuring that the protocol is better prepared to respond to active threats. * * * ## **Adoption Details** Pareto will adopt the agreement with the following parameters. 1. **Asset Recovery Address: Addresses controlled by Pareto, which recovered funds will be returned to in the event of a hack.** | | | | --- | --- | | **Chain** | **Address** | | Ethereum | 0xfb3bd022d5dacf95ee28a6b07825d4ff9c5b3814 | | Optimism | 0xFDbB4d606C199F091143BD604C85c191a526fbd0 | | Arbitrum | 0xf40d482d7fc94c30b256dc7e722033bae68ecf90 | | Polygon | 0x61A944Ca131Ab78B23c8449e0A2eF935981D5cF6 | 1. **Scope: List of all on-chain assets protected under Safe Harbor** | Chain | Name | Address | Type (None, Existing Only, All) | | --- | --- | --- | --- | | Ethereum | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Optimism | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Arbitrum | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | | Polygon | Pareto Deployer | 0xE5Dab8208c1F4cce15883348B72086dBace3e64B | All | - “All”: The Safe Harbor Agreement will cover both the subcontracts currently deployed under this contract and any future subcontracts deployed through it. This ensures that all present and future subcontracts are protected. - In this case, all contracts deployed by the Pareto Deployer EOA would be under scope 1. **Contact Details: Designated security contact for Pareto** 2. **Bounty Terms: Predetermined rewards for successful whitehats that protect protocol funds** * * * ## **Implementation Plan** 1. **Register Agreement On-Chain** : 2. **Communicate Adoption** : 3. **Future Updates to Scope:** * * * ## **Conclusion** Adopting the SEAL Whitehat Safe Harbor Agreement equips Pareto with a rapid response mechanism for active exploits, enabling whitehats to step in effectively when needed most. The agreement provides clear guidelines for action, increasing the protection of user funds and demonstrating Pareto’s commitment to proactive security. * * * ## **References** - **SEAL Whitehat Safe Harbor Agreement** : https://github.com/security-alliance/safe-harbor - **Pareto Bug Bounty** : [Immunefi Bug Bounty](https://immunefi.com/bug-bounty/pareto/information/) * * * _Please share your thoughts and feedback in the discussion below before the proposal moves to a formal vote._ ---
**Author:** ![Dickson](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Dickson](https://gov.pareto.credit/u/Dickson)\ **Post date:** [July 24, 2025, 4:46pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/7 "2025-07-24T16:46:27Z")
The updated proposal has 2 changes: Fixing the typo from 50.000 to 50,000 - Sorry about that! Changing retainable = True, to retainable = False. This means that whitehats are now required to send **all** funds back to the protocol first before receiving their bounty. Before this was not the case, but after some discussion with William, we’ve decided to set the retainable = false! ---
**Author:** ![william](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/william/32/10_2.png) [@william](https://gov.pareto.credit/u/william)\ **Post date:** [July 25, 2025, 9:25am UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/8 "2025-07-25T09:25:38Z")
Proposal is now published on Snapshot [https://snapshot.box/#/s:idlefinance.eth/proposal/0xeea476267b5488f6b79705eab938c477b145cc61f013e5294081c5d48d56f906](https://snapshot.box/#/s:idlefinance.eth/proposal/0xeea476267b5488f6b79705eab938c477b145cc61f013e5294081c5d48d56f906) Voting period: 2025-07-25T09:25:00Z→2025-07-28T09:24:00Z ---
**Author:** ![william](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/william/32/10_2.png) [@william](https://gov.pareto.credit/u/william)\ **Post date:** [July 28, 2025, 12:55pm UTC](https://gov.pareto.credit/t/iip-43-adopt-the-seal-safe-harbor-agreement/1323/9 "2025-07-28T12:55:30Z")
Snapshot vote passed with 587k “For” votes so the agreement is effective from now ![image](https://canada1.discourse-cdn.com/flex031/uploads/idle/original/2X/a/ab59d57969096dc7ebd3bb9c03d6a364773102f6.png)