> For the complete documentation index, see [llms.txt](https://heroarenagame.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heroarenagame.gitbook.io/docs/12.-security-and-audit.md).

# 12. Security & Audit

Hero Arena Play's security posture is the foundation on which player trust is built. This section is the most honest answer we can give to "should I trust this project with my money?"

### 12.1 Current Status (Honest) <a href="#id-121-current-status-honest" id="id-121-current-status-honest"></a>

As of this whitepaper's publication, Hero Arena Play's mainnet smart contracts have **not yet been audited**. The current contracts are deployed on BSC testnet only, and **no real value is at risk on testnet**.

A full third-party audit is **a hard prerequisite for the public IDO**. Hero Arena Play will not launch the $HAP token, will not list on any DEX, and will not migrate any contracts to BNB Chain mainnet until the audit is complete and the report is publicly available. This is non-negotiable.

We list this status openly because Launchpad investors and community members have the right to know exactly where the project stands.

### 12.2 Pre-Mainnet Security Plan <a href="#id-122-pre-mainnet-security-plan" id="id-122-pre-mainnet-security-plan"></a>

Before mainnet TGE, the following will be completed:

**Hard precondition for IDO.** No IDO will be conducted, no $HAP tokens will be minted on mainnet, and no liquidity will be deployed until the audit is complete, all critical/high-severity findings are remediated, and the audit report is publicly accessible.

#### Smart Contract Audit <a href="#smart-contract-audit" id="smart-contract-audit"></a>

* **Auditor:** To be audited by Cyberscope, please check the link below to see their full Audit report. [https://cyberscope.io/audits/hap](https://t.co/E7hDZnXNBt)
* **Scope:** Full audit of all token, vesting, NFT, marketplace, staking, and game settlement contracts
* **Report:** Will be published in full on this page before TGE.
* **Issues:** Any critical or high-severity findings will be remediated and re-audited before mainnet deployment

#### Bug Bounty Program <a href="#bug-bounty-program" id="bug-bounty-program"></a>

A public bug bounty will open following the audit but before TGE, allowing white-hat researchers to find issues the audit missed. Bounty tiers:

| Severity | Reward (in $HAP-equivalent USD) |
| -------- | ------------------------------- |
| Critical | $25,000 – $100,000              |
| High     | $5,000 – $25,000                |
| Medium   | $1,000 – $5,000                 |
| Low      | $100 – $1,000                   |

Bounty execution will be hosted on a recognized platform such as Immunefi to ensure professional triage and payout.

#### Multi-Signature Treasury <a href="#multi-signature-treasury" id="multi-signature-treasury"></a>

Before TGE, all team-controlled funds (Treasury, Ecosystem, Marketing allocations) will be moved to a **3-of-5 multi-sig wallet**. The five signer addresses will be published on this page with the role and pseudonym/name of each signer.

#### Liquidity Lock <a href="#liquidity-lock" id="liquidity-lock"></a>

Initial DEX liquidity will be locked for **24 months minimum** via a recognized liquidity lock service (e.g. UNCX, Pinksale, Team.Finance). The lock contract address and unlock date will be published on this page at TGE.

### 12.3 Game Integrity & Anti-Cheat <a href="#id-123-game-integrity--anti-cheat" id="id-123-game-integrity--anti-cheat"></a>

A game's economy is only as healthy as its anti-cheat measures.

**Server-side validation.** Match outcomes are validated by a deterministic game server before being committed on chain. Client-side actions cannot fabricate wins.

**On-chain settlement.** Final match outcomes (winner, MMR change, $HAP reward) are committed on chain, providing a public audit trail.

**Bot detection.** The game server runs heuristic and ML-based detection on action patterns (timing distributions, inhuman accuracy, multi-account play). Suspicious accounts face a graduated response: warning → reward freeze → permanent ban.

**Reward caps per wallet.** Daily $HAP earning caps prevent any single wallet from extracting disproportionate rewards even if cheating slips through other defenses.

**Replay system.** Every match generates a replay file viewable by other players, supporting community-led cheat detection.

### 12.4 Self-Custody & User Safety <a href="#id-124-self-custody--user-safety" id="id-124-self-custody--user-safety"></a>

**Hero Arena Play never holds player funds or assets.** All player tokens and NFTs remain in the player's own wallet at all times. Game contracts have approval-based access only — players grant specific approvals for specific actions, and those approvals can be revoked at any time.

We strongly recommend players:

* Use a hardware wallet (Ledger, Trezor) for high-value Hero Arena Play assets
* Verify the official contract addresses (published at TGE on this page) against any contract before approving
* Never share seed phrases — Hero Arena Play team members will never ask for them
* Be vigilant about phishing — the only authoritative URLs are listed in Official Links

### 12.5 Reporting Vulnerabilities <a href="#id-125-reporting-vulnerabilities" id="id-125-reporting-vulnerabilities"></a>

If you discover a vulnerability, please report it responsibly:

* **Report via direct message** to [@HeroArenaGroup](https://t.me/HeroArenaGroup) on Telegram, or by email to <contact@hero-arena.com> (PGP key will be published before TGE).
* **Bug bounty platform:** Hosted on Immunefi (link will be published when the program goes live).

Please do **not** disclose vulnerabilities publicly until they have been triaged and remediated. We commit to acknowledging reports within 48 hours and remediating critical issues within 14 days.