Safe Harbor Protection

Understanding the legal protections for whitehats on BattleChain

What is Safe Harbor?

Safe Harbor is a legal framework that protects whitehats who attack contracts on BattleChain. When a protocol adopts a Safe Harbor agreement and their contracts enter attack mode, they commit to not pursuing legal action against whitehats who follow the rules.

What's Protected

When attacking contracts in UNDER_ATTACK or PROMOTION_REQUESTED state:

• Exploiting vulnerabilities in in-scope contracts
• Extracting funds from vulnerable contracts
• Keeping your bounty percentage (up to the cap)
• Acting without prior coordination
• Remaining anonymous (if allowed by terms)

What's NOT Protected

Safe Harbor does NOT cover:

• Attacking PRODUCTION contracts
• Attacking contracts outside the agreement's scope
• Keeping more than your bounty entitlement
• Ignoring identity requirements
• Causing harm beyond the exploit itself

The Agreement Structure

Every Safe Harbor agreement includes:

struct AgreementDetails {
    string protocolName;        // Who is this?
    Contact[] contactDetails;   // How to reach them
    Chain[] chains;             // What's in scope
    BountyTerms bountyTerms;    // What you earn
    string agreementURI;        // Full legal document
}

Commitment Window

Protocols commit to not changing terms unfavorably during a commitment window:

uint256 cantChangeUntil = agreement.getCantChangeUntil();

During this window, they cannot:

• Reduce bounty percentage or caps
• Remove contracts from scope
• Make identity requirements stricter
• Change from retainable to return-all

This protects you from "bait and switch" tactics.

Verifying Protection

Before attacking, always verify:

// 1. Agreement is valid
bool valid = safeHarborRegistry.isAgreementValid(agreementAddress);

// 2. Contract is attackable
bool attackable = attackRegistry.isTopLevelContractUnderAttack(contractAddress);

// 3. Contract is in scope
bool inScope = agreement.isContractInScope(contractAddress);

The Agreement Document

The agreementURI points to the full legal document:

string memory uri = agreement.getAgreementURI();
// e.g., "ipfs://QmXXXXXX"

On-chain data is a summary; the URI document is authoritative.

If Something Goes Wrong

Protocol Claims Violation

1. Document your compliance (transactions, calculations)
2. Show you met all requirements
3. Involve neutral parties if needed

Terms Changed Unfavorably

1. Check if changes were during commitment window
2. Archive evidence of state at attack time
3. Escalate to DAO for arbitration

Due Diligence