1. Overview:
This SIP proposes that the Lazy Summer DAO formally adopt the SEAL (Security Alliance) Whitehat Safe Harbor Agreement, enabling authorized whitehats to intervene during active exploits under predefined rules, incentives, and legal protections.
2. Motivation:
Lazy Summer Protocol operates DAO-governed, risk-assessed vaults designed for simplicity and passive participation. While audits, monitoring, and risk reviews are essential preventative controls, they do not eliminate the possibility of active exploits.
During a live exploit, speed and clarity matter more than process purity.
Traditional responsible disclosure frameworks are too slow in situations where funds are actively being drained. The SEAL Safe Harbor Agreement creates a pre-authorized, rule-bound framework that allows vetted whitehats to intervene immediately and recover funds without legal ambiguity.
Adopting Safe Harbor provides:
- A last-line-of-defense mechanism during active exploits.
- Clear predefined bounty expectations.
- Removal of post-exploit negotiation ambiguity.
- Alignment with industry-standard incident response practices.
3. Specification:
3.1 Adoption of the SEAL Safe Harbor Agreement
Lazy Summer DAO will formally adopt the SEAL Whitehat Safe Harbor Agreement under the following finalized parameters.
Protocol Details
Protocol Name: Lazy Summer Protocol
Summer Governor: 0xBE5A4DD68c3526F32B454fE28C9909cA0601e9Fa
Timelock Address: 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796
Protocol Access Manager: 0xf389BCEa078acD9516414F5dabE3dDd5f7e39694
Bounty Terms
Based on [RFC] feedback and informal signaling:
- Percentage: 10% of recovered funds
- Per-Incident Cap: $100,000 USD
- Aggregate Cap: $100,000 USD
- Retainable: No (non-retainable; all funds must be returned first)
- Identity Requirement: Pseudonymous
Clarifications:
- Whitehats may intervene only during active exploits.
- All recovered funds must be returned to designated recovery addresses within 72 hours.
- Bounty is paid after verification by the protocol.
- Safe Harbor does not apply to routine bug bounty disclosures or security research.
Diligence Requirements
Whitehats acting under Safe Harbor must:
- Act in good faith to minimize harm.
- Only interact with contracts strictly necessary to halt or mitigate the exploit.
- Return all recovered funds within 72 hours.
- Identify themselves pseudonymously to designated security contacts for coordination.
Designated Security Contacts
The following contributors are nominated as Safe Harbor coordination contacts:
- LS Guardians: @jensei @blockful @Raphael_Anode @halaprix @MasterMojo @JavierD @chrisb @Sixty - via Signal Group
- @BlockAnalitica (on risk coordination)
- Labs Co
- Lazy Summer Foundation
Chains & Asset Recovery Addresses
Recovery addresses are defined per supported chain and controlled by the DAO or Guardian structure.
DAO-governed Timelock/Treasury Address:
- Ethereum:
0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796 - Optimism:
0x25B97896A1d731875B3aec785977E421029Fc90A - Unichain:
0x25B97896A1d731875B3aec785977E421029Fc90A - Sonic:
0x4c32A28AD95deaBc06bF7C83AdEbCF6fe6721ED9 - Arbitrum:
0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796 - Base:
0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796 - HyperEVM:
0x0C939b702524fDaBa4914E905Bcb850182308141
In case of timelock compromise, use Guardian Multisig:
- Ethereum:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - Optimism:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - Unichain:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - Sonic:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - Arbitrum:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - Base:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 - HyperEVM:
0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
Initial coverage includes:
- Ethereum: summer-earn-protocol/packages/deployment/ignition/deployments/chain-1/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- Optimism: summer-earn-protocol/packages/deployment/ignition/deployments/chain-10/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- Unichain: summer-earn-protocol/packages/deployment/ignition/deployments/chain-130/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- Sonic: summer-earn-protocol/packages/deployment/ignition/deployments/chain-146/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- Arbitrum: summer-earn-protocol/packages/deployment/ignition/deployments/chain-42161/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- Base: summer-earn-protocol/packages/deployment/ignition/deployments/chain-8453/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
- HyperEVM: summer-earn-protocol/packages/deployment/ignition/deployments/chain-999/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub
Scope Definition
ChildContractScope:
All
All contracts and child contracts deployed prior and after to adoption are in scope.
3.2 Implementation Plan
- Register Agreement Onchain
The finalized parameters will be registered in the SEAL Safe Harbor Registry:
0x1eaCD100B0546E433fbf4d773109cAD482c34686 - Instruct Labs Co to Update Terms of Service & Docs
To ensure all users are informed and legally covered. - An official announcement shall be shared across all communication channels, explaining the adoption and its significance to the community.
4. Risk Assessment:
Operational risk can involve miscommunication during an exploit leading to confusion.
Mitigation:
- Predefined recovery addresses
- Designated security contacts
- Registry-based transparency
5. Voting:
If YES: Lazy Summer DAO formally adopts the SEAL Whitehat Safe Harbor Agreement.
If NO: The DAO declines to adopt the Safe Harbor framework at this time.
Tagging all @Recognized_Delegates for review, before it is posted for an onchain vote ~18/02/2026.
