> For the complete documentation index, see [llms.txt](https://docs.lagomchain.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lagomchain.com/security-overview/simple-arrangement-for-funding-upload-safu.md).

# Simple Arrangement for Funding Upload (SAFU)

The **Simple Arrangement for Funding Upload (SAFU)** defines LagomChain’s post-exploit policy for handling active security vulnerabilities. SAFU is designed to encourage white hat hackers to responsibly return exploited funds while offering a structured bounty system as a reward.

### **Key SAFU Guidelines**

* **Legal Protection for White Hats**
  * Hackers who follow SAFU guidelines will not face legal action.
* **Grace Period for Returning Funds**
  * White hat hackers must return exploited funds to a designated dropbox address within a grace period to qualify for rewards.
* **Bounty Rewards for Secured Funds**
  * A percentage of recovered funds (up to a predefined bounty cap) will be awarded.
  * Rewards are distributed during the next network upgrade.
* **KYC/KYB for High-Value Rewards**
  * If a reward exceeds a certain threshold, the recipient must complete Know Your Client (KYC) / Know Your Business (KYB) verification.
* **Exclusion of Malicious Actors**
  * Hackers who exploit vulnerabilities for malicious purposes are not eligible for rewards.
* **Scope of Eligible Funds**
  * White hat hackers will not receive rewards for funds retrieved from "Out of Scope Projects" (i.e., projects without their own SAFU program).

For full details, visit the LagomChain SAFU Agreement.

### **SAFU Dropbox Address**

The **Dropbox Address** is a secure, protocol-controlled wallet where white hat hackers should deposit recovered funds.

This address is not controlled by any individual or team—it is fully governed by the LagomChain protocol.

#### **LagomChain SAFU Dropbox Address:**

* **Bech32 Format:**\
  `lagom1c6jdy4gy86s69auueqwfjs86vse7kz3grxm9h2`
* **Hex Format:**\
  `0xc6A4d255043ea1A2F79CC81c9940FA6433eb0A28`

### **Address Derivation**

The Dropbox Address is cryptographically derived using the first 20 bytes of the SHA256 hash of the "safu" string, ensuring immutability and security.

```go
goCopyEditaddress = sha256.Sum256([]byte("safu"))[:20]
```

### **How White Hats Can Secure Vulnerable Funds**

1. Identify the exploit and secure the compromised funds.
2. Transfer the funds to the SAFU Dropbox Address within the Grace Period.
3. Follow the SAFU guidelines to remain eligible for a bounty.

### **How to Claim a Bounty Reward**

* Rewards will be distributed during the next network upgrade.
* For high-value rewards, KYC/KYB verification is required.

### **Security Recommendations for dApps on LagomChain**

LagomChain’s SAFU program does not cover funds from individual dApps. Therefore, all dApps are encouraged to implement their own SAFU mechanisms to protect against security threats.

#### **Recommended Implementation:**

* Use [SAFU.sol](https://github.com/JumpCrypto/Safu/) from Jump Crypto as a reference for secure fund recovery.

###