Incident response

Status: prepared process; owners and reporting channel not yet assigned.

Severity

• SEV-1: wrong contract published by an official account, website/DNS phishing, suspected creator/treasury wallet compromise, or evidence of project-led market manipulation. Activate the website alert, pause affected publishing, preserve evidence and coordinate account/access recovery through service owners. Seek appropriate specialist support.
• SEV-2: widely shared impersonation or fake contract, incorrect metadata, moderator misconduct, missing sponsored disclosure or incorrect treasury report. Correct the record, limit affected permissions, publish a factual update and review the control that failed.
• SEV-3: link typo, isolated scam DM, community rule breach or misunderstood meme. Correct/remove, record and monitor escalation.

Response sequence

1. Record detection time, source, impact, incident lead and severity.
2. Verify the trusted configuration using an independent source. Never copy a reported suspicious address into the official config.
3. Set scamAlert.enabled with factual guidance, rebuild and deploy through a trusted account. If the host is compromised, use independently verified channels.
4. Assign the comms lead to publish approved updates through verified channels. Prepared copy does not itself authorize sending messages.
5. Rotate or revoke affected service access through the accountable owner. Wallet operations require separately authorized, reviewed actions; never share recovery material.
6. Validate restoration with an independent verifier. Keep the alert until the impact is contained.
7. Publish an incident report, correction and follow-up checklist. Record unresolved risk.

Use the repository’s ops/incident-templates/report.md and fake-contract.md templates. Before launch, rehearse fake contract, wrong official address, account compromise, wallet compromise suspicion and disclosure correction scenarios.