Adopt the SEAL Whitehat Safe Harbor Agreement

1. Overview: This SIP proposes that the Lazy Summer DAO formally adopt the SEAL (Security Alliance) Whitehat Safe Harbor Agreement, enabling authorized whitehats to intervene during active exploits under predefined rules, incentives, and legal protections.

RFC: [RFC] Adopt the SEAL Whitehat Safe Harbor Agreement

---

2. Motivation:

Lazy Summer Protocol operates DAO-governed, risk-assessed vaults designed for simplicity and passive participation. While audits, monitoring, and risk reviews are essential preventative controls, they do not eliminate the possibility of active exploits. During a live exploit, speed and clarity matter more than process purity. Traditional responsible disclosure frameworks are too slow in situations where funds are actively being drained. The SEAL Safe Harbor Agreement creates a pre-authorized, rule-bound framework that allows vetted whitehats to intervene immediately and recover funds without legal ambiguity. Adopting Safe Harbor provides:

• A last-line-of-defense mechanism during active exploits.
• Clear predefined bounty expectations.
• Removal of post-exploit negotiation ambiguity.
• Alignment with industry-standard incident response practices.

---

3. Specification:

3.1 Adoption of the SEAL Safe Harbor Agreement

Lazy Summer DAO will formally adopt the SEAL Whitehat Safe Harbor Agreement under the following finalized parameters.

Protocol Details

Protocol Name: Lazy Summer Protocol Summer Governor: 0xBE5A4DD68c3526F32B454fE28C9909cA0601e9Fa Timelock Address: 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796 Protocol Access Manager: 0xf389BCEa078acD9516414F5dabE3dDd5f7e39694

Bounty Terms

Based on [RFC] feedback and informal signaling:

• Percentage: 10% of recovered funds
• Per-Incident Cap: $100,000 USD
• Aggregate Cap: $100,000 USD
• Retainable: No (non-retainable; all funds must be returned first)
• Identity Requirement: Pseudonymous Clarifications:
• Whitehats may intervene only during active exploits.
• All recovered funds must be returned to designated recovery addresses within 72 hours.
• Bounty is paid after verification by the protocol.
• Safe Harbor does not apply to routine bug bounty disclosures or security research.

Diligence Requirements

Whitehats acting under Safe Harbor must:

• Act in good faith to minimize harm.
• Only interact with contracts strictly necessary to halt or mitigate the exploit.
• Return all recovered funds within 72 hours.
• Identify themselves pseudonymously to designated security contacts for coordination.

Designated Security Contacts

The following contributors are nominated as Safe Harbor coordination contacts:

• LS Guardians: @jensei @blockful @Raphael_Anode @halaprix @MasterMojo @JavierD @chrisb @Sixty - via Signal Group
• @BlockAnalitica (on risk coordination)
• Labs Co
• Lazy Summer Foundation

Chains & Asset Recovery Addresses

Recovery addresses are defined per supported chain and controlled by the DAO or Guardian structure. DAO-governed Timelock/Treasury Address:

• Ethereum: 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796
• Optimism: 0x25B97896A1d731875B3aec785977E421029Fc90A
• Unichain: 0x25B97896A1d731875B3aec785977E421029Fc90A
• Sonic: 0x4c32A28AD95deaBc06bF7C83AdEbCF6fe6721ED9
• Arbitrum: 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796
• Base: 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796
• HyperEVM: 0x0C939b702524fDaBa4914E905Bcb850182308141 In case of timelock compromise, use Guardian Multisig:
• Ethereum: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• Optimism: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• Unichain: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• Sonic: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• Arbitrum: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• Base: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4
• HyperEVM: 0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4 Initial coverage includes:
• Ethereum: summer-earn-protocol/packages/deployment/ignition/deployments/chain-1/deployed_addresses.json at main · OasisDEX/summer-earn-protocol · GitHub

Scope Definition

ChildContractScope: All All contracts and child contracts deployed prior and after to adoption are in scope.

3.2 Implementation Plan

1. Register Agreement Onchain The finalized parameters will be registered in the SEAL Safe Harbor Registry: 0x1eaCD100B0546E433fbf4d773109cAD482c34686
2. Instruct Labs Co to Update Terms of Service & Docs To ensure all users are informed and legally covered.
3. An official announcement shall be shared across all communication channels, explaining the adoption and its significance to the community.

---

4. Risk Assessment:

Operational risk can involve miscommunication during an exploit leading to confusion. Mitigation:

• Predefined recovery addresses
• Designated security contacts
• Registry-based transparency

---

5. Voting:

If YES: Lazy Summer DAO formally adopts the SEAL Whitehat Safe Harbor Agreement. If NO: The DAO declines to adopt the Safe Harbor framework at this time.