Security

How to report a vulnerability in Juice, and what's in scope.

Reporting a vulnerability

Please include:

• what's affected (the page, API endpoint or program and instruction);
• the steps to reproduce it, or a proof of concept;
• what an attacker could do with it, and what it would take;
• how we can reach you, and whether you'd like to be credited.

We'll acknowledge your report within about 3 business days and keep you posted while we work on a fix. You can write in English or German.

Please:

• don't exploit the issue beyond what's needed to show it exists;
• don't access or move funds that aren't yours, and test only with your own wallets and small amounts;
• don't disclose the issue publicly until we've fixed it and agreed on a date with you.

Some of our programs' on-chain security.txt still name a direct message to @JuicePools on X. Email is the preferred channel; please send the details there.

Scope

• The website juicepools.app
• The API api.juicepools.app
• Juice's on-chain programs on Solana mainnet:

• Limit and range orders (juice_orders) GcuS1sYoTJ1MWDiTFyyTXmSj9GET6kUGkmWKo6Zz1FTQ
• Liquidity orders (juice_lp) Ajff1hUmzgAw3DEasySNM1S5prWUWSthL3qr81zSvQ8H
• DCA plans (juice_dca) BWTsfWJ8nMxUQrKPLV8jsDusbvY2UdDmc11xJxLM2XHP
• Band (juice_band) Bg9eVeB54EfAR791nYFsAFsUmTd1D8rENKCCQkCtkZMw
• Staking (juice_stake) CAkTMGM5UtjctMpGvNuucfqCudjEHgmoH2SGVt3ts2aL
• Boosts (juice_boost) 76rjaNmZQWkDy9ZtJUYAoVVA4jfcatdrfUS9tcCjXain
• Liquidity lock (juice_lock) 544vBp5c5GHJwNDm4YmS4FK24to9YP17iJLSXmcjFtmG Immutable: its upgrade authority was revoked on 2026-10-17, so nobody can change it. Source: github.com/applicure/juice-lock, verified build (OtterSec, 2026-10-19).

The other programs are upgradeable by a key held by the Juice team.

Out of scope: third-party services, including PumpSwap, wallets and RPC providers; social engineering of our team or users; and denial-of-service attacks.

Audits

Each program was reviewed before launch by AI-agent security audits (independent Claude agent audits and a final review). No external audit firm has audited them. Reviews like these can miss things, which is why your report matters.

Recognition

There is no bug bounty with set amounts; any reward is at our discretion. With your permission, we're glad to credit you once the issue is fixed.