Security

Built to keep fans' SOL safe

What the StakeStage program guarantees, what's still in beta, and how to report a vulnerability.

Beta status

StakeStage is in beta. Its Solana program has been reviewed internally but hasn't had an independent security audit yet. Until it has:

Each token's curve can hold at most 20 SOL. The limit is enforced by the program itself; buys past it fail. It caps what anyone could lose if a bug were found.
Selling is never blocked, even when a curve is full.
Artists join by invite, so every listed token belongs to an artist we've talked to.

The limit will be raised step by step after an independent audit.

What the program guarantees

Every artist token has a fixed supply of 1,000,000,000. Minting is switched off for good at launch, and tokens can't be frozen.
The SOL backing a curve can only leave it when holders sell; only the trading fees are paid out, to the artist and the platform. There is no admin withdrawal.
Selling can't be paused. Buying and new launches can be paused in an emergency.
Trading fees are at most 2% and fixed per token at launch; half goes to the artist.
The artist's first purchase happens in the same transaction as the launch, so nobody can buy before them.
Collectible cards are minted only with a platform-signed voucher, one per wallet per release, and can't be transferred.

Who controls what

Program upgrades and admin settings (fees for new launches, the beta limit, pauses) are controlled by the StakeStage team. An upgrade could change the rules above, so on mainnet this control sits with a multisig that needs several signatures — no single person or key can act alone.
The card voucher key lives on the StakeStage server. It can only mint collectible cards, never move SOL or tokens.

Program: 3ACyAupxuYyTLNcQcpW2bfks9zsmyTdY1LJs7WSeXsjN

Bug bounty

Found a way to break StakeStage? Tell us privately and we'll pay for it. In scope: the StakeStage Solana program and this website (sign-in, holder-only content, card vouchers, APIs). Out of scope: wallet apps, spam or denial of service, social engineering, and issues that need a compromised device.

CriticalAnyone can take SOL out of a curve, mint tokens, or stop holders from selling.Our top reward

HighForging collectible cards at scale, taking someone's fee share, or reading holder-only content without holding.Reward by impact

MediumWrong prices or balances shown that could mislead a buyer; signing in as another wallet.Reward by impact

LowSmaller issues with a real security impact.Thanks + credit

Rewards depend on severity and the funds at risk. The first reporter of an issue gets the reward.

Rules

Test on devnet or your own local copy. Never touch other people's funds or data.
Show the problem with the smallest possible proof; don't exploit it further.
Report privately and give us time to fix it before telling anyone. We reply within 72 hours.
If you follow these rules in good faith, we won't pursue legal action against you.

How to report

The reporting address will be published here before the public beta.

Questions about tokens and risks? Read the notes on any artist page before you buy.