Security is part of the infrastructure.
This page documents the security posture for CO45T-owned contracts and web infrastructure. It is a supporting project policy, not the token's primary purpose.
Security contact
Report security issues to security@co45t.com. Do not include private keys, seed phrases or credentials in a report.
Current security posture
The C45 token and six custom vesting contracts are source verified on BaseScan. The public website is static, does not connect wallets and does not request signatures. Treasury reserves are held across six 2-of-3 Safe accounts.
Good-faith research
When testing CO45T-owned code or infrastructure, keep activity non-destructive and limited to what is necessary to demonstrate an issue.
- Demonstrate the issue with the minimum interaction needed.
- Avoid accessing or modifying third-party data or assets.
- Avoid phishing, social engineering, denial-of-service and destructive testing.
- Allow time for coordinated remediation before public disclosure.
Public bounty status
CO45T does not currently advertise a public vulnerability bounty through this website. Do not rely on third-party claims of CO45T reward eligibility unless they are linked from co45t.com.
Deployment verification
The live C45 token, vesting and Safe addresses are published in the deployment registry. The linked BaseScan pages provide the canonical on-chain verification path.