chore: add security contact to the contracts

tmigone · tmigone · commit 4f60b0c17b2f · 2025-02-28T11:10:52.000-03:00
Signed-off-by: Tomás Migone &lt;tomas@edgeandnode.com&gt;
diff --git a/packages/horizon/contracts/data-service/DataService.sol b/packages/horizon/contracts/data-service/DataService.sol
@@ -27,6 +27,8 @@ import { ProvisionManager } from "./utilities/ProvisionManager.sol";
  * will be required in the constructor.
  * - Note that in both cases if using {__DataService_init_unchained} variant the corresponding parent
  * initializers must be called in the implementation.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataService is GraphDirectory, ProvisionManager, DataServiceV1Storage, IDataService {
     /**
diff --git a/packages/horizon/contracts/data-service/DataServiceStorage.sol b/packages/horizon/contracts/data-service/DataServiceStorage.sol
@@ -1,6 +1,12 @@
 // SPDX-License-Identifier: GPL-3.0-or-later
 pragma solidity 0.8.27;
 
+/**
+ * @title DataServiceStorage
+ * @dev This contract holds the storage variables for the DataService contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
+ */
 abstract contract DataServiceV1Storage {
     /// @dev Gap to allow adding variables in future upgrades
     /// Note that this contract is not upgradeable but might be inherited by an upgradeable contract
diff --git a/packages/horizon/contracts/data-service/extensions/DataServiceFees.sol b/packages/horizon/contracts/data-service/extensions/DataServiceFees.sol
@@ -16,6 +16,8 @@ import { DataServiceFeesV1Storage } from "./DataServiceFeesStorage.sol";
  * using a Horizon provision. See {IDataServiceFees} for more details.
  * @dev This contract inherits from {DataService} which needs to be initialized, please see
  * {DataService} for detailed instructions.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataServiceFees is DataService, DataServiceFeesV1Storage, IDataServiceFees {
     using ProvisionTracker for mapping(address => uint256);
diff --git a/packages/horizon/contracts/data-service/extensions/DataServiceFeesStorage.sol b/packages/horizon/contracts/data-service/extensions/DataServiceFeesStorage.sol
@@ -7,6 +7,8 @@ import { LinkedList } from "../../libraries/LinkedList.sol";
 
 /**
  * @title Storage layout for the {DataServiceFees} extension contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataServiceFeesV1Storage {
     mapping(address serviceProvider => uint256 tokens) public feesProvisionTracker;
diff --git a/packages/horizon/contracts/data-service/extensions/DataServicePausable.sol b/packages/horizon/contracts/data-service/extensions/DataServicePausable.sol
@@ -16,6 +16,8 @@ import { DataService } from "../DataService.sol";
  * guardians. This should be implemented in the derived contract.
  * @dev This contract inherits from {DataService} which needs to be initialized, please see
  * {DataService} for detailed instructions.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataServicePausable is Pausable, DataService, IDataServicePausable {
     /// @notice List of pause guardians and their allowed status
diff --git a/packages/horizon/contracts/data-service/extensions/DataServicePausableUpgradeable.sol b/packages/horizon/contracts/data-service/extensions/DataServicePausableUpgradeable.sol
@@ -12,6 +12,8 @@ import { DataService } from "../DataService.sol";
  * @dev Upgradeable version of the {DataServicePausable} contract.
  * @dev This contract inherits from {DataService} which needs to be initialized, please see
  * {DataService} for detailed instructions.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataServicePausableUpgradeable is PausableUpgradeable, DataService, IDataServicePausable {
     /// @notice List of pause guardians and their allowed status
diff --git a/packages/horizon/contracts/data-service/extensions/DataServiceRescuable.sol b/packages/horizon/contracts/data-service/extensions/DataServiceRescuable.sol
@@ -19,6 +19,8 @@ import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.s
  * rescuers. This should be implemented in the derived contract.
  * @dev This contract inherits from {DataService} which needs to be initialized, please see
  * {DataService} for detailed instructions.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract DataServiceRescuable is DataService, IDataServiceRescuable {
     /// @notice List of rescuers and their allowed status
diff --git a/packages/horizon/contracts/data-service/interfaces/IDataService.sol b/packages/horizon/contracts/data-service/interfaces/IDataService.sol
@@ -12,6 +12,8 @@ import { IGraphPayments } from "../../interfaces/IGraphPayments.sol";
  * the implementation code and the documentation.
  * @dev This interface is expected to be inherited and extended by a data service interface. It can be
  * used to interact with it however it's advised to use the more specific parent interface.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IDataService {
     /**
diff --git a/packages/horizon/contracts/data-service/interfaces/IDataServiceFees.sol b/packages/horizon/contracts/data-service/interfaces/IDataServiceFees.sol
@@ -18,6 +18,8 @@ import { IDataService } from "./IDataService.sol";
  * @dev Note that this implementation uses the entire provisioned stake as collateral for the payment.
  * It can be used to provide economic security for the payments collected as long as the provisioned
  * stake is not being used for other purposes.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IDataServiceFees is IDataService {
     /**
diff --git a/packages/horizon/contracts/data-service/interfaces/IDataServicePausable.sol b/packages/horizon/contracts/data-service/interfaces/IDataServicePausable.sol
@@ -8,6 +8,8 @@ import { IDataService } from "./IDataService.sol";
  * @notice Extension for the {IDataService} contract, adds pausing functionality
  * to the data service. Pausing is controlled by privileged accounts called
  * pause guardians.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IDataServicePausable is IDataService {
     /**
diff --git a/packages/horizon/contracts/data-service/interfaces/IDataServiceRescuable.sol b/packages/horizon/contracts/data-service/interfaces/IDataServiceRescuable.sol
@@ -7,6 +7,8 @@ import { IDataService } from "./IDataService.sol";
  * @title Interface for the {IDataServicePausable} contract.
  * @notice Extension for the {IDataService} contract, adds the ability to rescue
  * any ERC20 token or ETH from the contract, controlled by a rescuer privileged role.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IDataServiceRescuable is IDataService {
     /**
diff --git a/packages/horizon/contracts/data-service/libraries/ProvisionTracker.sol b/packages/horizon/contracts/data-service/libraries/ProvisionTracker.sol
@@ -10,6 +10,8 @@ import { IHorizonStaking } from "../../interfaces/IHorizonStaking.sol";
  * their services.
  * The library provides two primitives, lock and release to signal token usage and free up tokens respectively. It
  * does not make any assumptions about the conditions under which tokens are locked or released.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library ProvisionTracker {
     /**
diff --git a/packages/horizon/contracts/data-service/utilities/ProvisionManager.sol b/packages/horizon/contracts/data-service/utilities/ProvisionManager.sol
@@ -19,6 +19,8 @@ import { ProvisionManagerV1Storage } from "./ProvisionManagerStorage.sol";
  * The parameters are:
  * - Provision parameters (thawing period and verifier cut)
  * - Provision tokens
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract ProvisionManager is Initializable, GraphDirectory, ProvisionManagerV1Storage {
     using UintRange for uint256;
diff --git a/packages/horizon/contracts/data-service/utilities/ProvisionManagerStorage.sol b/packages/horizon/contracts/data-service/utilities/ProvisionManagerStorage.sol
@@ -3,6 +3,8 @@ pragma solidity 0.8.27;
 
 /**
  * @title Storage layout for the {ProvisionManager} helper contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract ProvisionManagerV1Storage {
     /// @notice The minimum amount of tokens required to register a provision in the data service
diff --git a/packages/horizon/contracts/interfaces/IAuthorizable.sol b/packages/horizon/contracts/interfaces/IAuthorizable.sol
@@ -5,6 +5,8 @@ pragma solidity 0.8.27;
  * @title Interface for the {Authorizable} contract
  * @notice Implements an authorization scheme that allows authorizers to
  * authorize signers to sign on their behalf.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IAuthorizable {
     /**
diff --git a/packages/horizon/contracts/interfaces/IGraphPayments.sol b/packages/horizon/contracts/interfaces/IGraphPayments.sol
@@ -6,6 +6,8 @@ pragma solidity 0.8.27;
  * @notice This contract is part of the Graph Horizon payments protocol. It's designed
  * to pull funds (GRT) from the {PaymentsEscrow} and distribute them according to a
  * set of pre established rules.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IGraphPayments {
     /**
diff --git a/packages/horizon/contracts/interfaces/IGraphProxyAdmin.sol b/packages/horizon/contracts/interfaces/IGraphProxyAdmin.sol
@@ -6,5 +6,7 @@ pragma solidity 0.8.27;
  * @title IGraphProxyAdmin
  * @dev Empty interface to allow the GraphProxyAdmin contract to be used
  * in the GraphDirectory contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IGraphProxyAdmin {}
diff --git a/packages/horizon/contracts/interfaces/IGraphTallyCollector.sol b/packages/horizon/contracts/interfaces/IGraphTallyCollector.sol
@@ -10,6 +10,8 @@ import { IGraphPayments } from "./IGraphPayments.sol";
  * Horizon payments protocol.
  * @notice Implements a payments collector contract that can be used to collect
  * payments using a GraphTally RAV (Receipt Aggregate Voucher).
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IGraphTallyCollector is IPaymentsCollector {
     /**
diff --git a/packages/horizon/contracts/interfaces/IHorizonStaking.sol b/packages/horizon/contracts/interfaces/IHorizonStaking.sol
@@ -12,5 +12,7 @@ import { IHorizonStakingExtension } from "./internal/IHorizonStakingExtension.so
  * @notice This interface exposes all functions implemented by the {HorizonStaking} contract and its extension
  * {HorizonStakingExtension} as well as the custom data types used by the contract.
  * @dev Use this interface to interact with the Horizon Staking contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IHorizonStaking is IHorizonStakingTypes, IHorizonStakingBase, IHorizonStakingMain, IHorizonStakingExtension {}
diff --git a/packages/horizon/contracts/interfaces/IPaymentsCollector.sol b/packages/horizon/contracts/interfaces/IPaymentsCollector.sol
@@ -12,6 +12,8 @@ import { IGraphPayments } from "./IGraphPayments.sol";
  *
  * @dev It's important to note that it's the collector contract's responsibility to validate the payment
  * request is legitimate.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IPaymentsCollector {
     /**
diff --git a/packages/horizon/contracts/interfaces/IPaymentsEscrow.sol b/packages/horizon/contracts/interfaces/IPaymentsEscrow.sol
@@ -13,6 +13,8 @@ import { IGraphPayments } from "./IGraphPayments.sol";
  * being able to retrieve them after a thawing period. Receivers collect funds from the escrow,
  * provided the payer has authorized them. The payer authorization is delegated to a payment
  * collector contract which implements the {IPaymentsCollector} interface.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IPaymentsEscrow {
     /**
diff --git a/packages/horizon/contracts/interfaces/internal/IHorizonStakingBase.sol b/packages/horizon/contracts/interfaces/internal/IHorizonStakingBase.sol
@@ -12,6 +12,8 @@ import { LinkedList } from "../../libraries/LinkedList.sol";
  * @notice Provides getters for {HorizonStaking} and {HorizonStakingExtension} storage variables.
  * @dev Most functions operate over {HorizonStaking} provisions. To uniquely identify a provision
  * functions take `serviceProvider` and `verifier` addresses.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IHorizonStakingBase {
     /**
diff --git a/packages/horizon/contracts/interfaces/internal/IHorizonStakingExtension.sol b/packages/horizon/contracts/interfaces/internal/IHorizonStakingExtension.sol
@@ -7,6 +7,8 @@ import { IRewardsIssuer } from "@graphprotocol/contracts/contracts/rewards/IRewa
 /**
  * @title Interface for {HorizonStakingExtension} contract.
  * @notice Provides functions for managing legacy allocations.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IHorizonStakingExtension is IRewardsIssuer {
     /**
diff --git a/packages/horizon/contracts/interfaces/internal/IHorizonStakingMain.sol b/packages/horizon/contracts/interfaces/internal/IHorizonStakingMain.sol
@@ -15,6 +15,8 @@ import { IHorizonStakingTypes } from "./IHorizonStakingTypes.sol";
  * @dev Most functions operate over {HorizonStaking} provisions. To uniquely identify a provision
  * functions take `serviceProvider` and `verifier` addresses.
  * @dev TRANSITION PERIOD: After transition period rename to IHorizonStaking.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IHorizonStakingMain {
     // -- Events: stake --
diff --git a/packages/horizon/contracts/interfaces/internal/IHorizonStakingTypes.sol b/packages/horizon/contracts/interfaces/internal/IHorizonStakingTypes.sol
@@ -7,6 +7,8 @@ pragma solidity 0.8.27;
  * @dev In order to preserve storage compatibility some data structures keep deprecated fields.
  * These structures have then two representations, an internal one used by the contract storage and a public one.
  * Getter functions should retrieve internal representations, remove deprecated fields and return the public representation.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface IHorizonStakingTypes {
     /**
diff --git a/packages/horizon/contracts/libraries/Denominations.sol b/packages/horizon/contracts/libraries/Denominations.sol
@@ -5,6 +5,8 @@ pragma solidity 0.8.27;
  * @title Denominations library
  * @dev Provides a list of ground denominations for those tokens that cannot be represented by an ERC20.
  * For now, the only needed is the native token that could be ETH, MATIC, or other depending on the layer being operated.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library Denominations {
     /// @notice The address of the native token, i.e ETH
diff --git a/packages/horizon/contracts/libraries/LibFixedMath.sol b/packages/horizon/contracts/libraries/LibFixedMath.sol
@@ -20,7 +20,12 @@
 
 pragma solidity 0.8.27;
 
-/// @dev Signed, fixed-point, 127-bit precision math library.
+/**
+ * @title LibFixedMath
+ * @notice This library provides fixed-point arithmetic operations.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
+ */
 library LibFixedMath {
     // 1
     int256 private constant FIXED_1 = int256(0x0000000000000000000000000000000080000000000000000000000000000000);
diff --git a/packages/horizon/contracts/libraries/LinkedList.sol b/packages/horizon/contracts/libraries/LinkedList.sol
@@ -16,6 +16,8 @@ pragma solidity 0.8.27;
  * A contract using this library must store:
  * - a LinkedList.List to keep track of the list metadata
  * - a mapping from bytes32 to the item data
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library LinkedList {
     using LinkedList for List;
diff --git a/packages/horizon/contracts/libraries/MathUtils.sol b/packages/horizon/contracts/libraries/MathUtils.sol
@@ -5,6 +5,8 @@ pragma solidity 0.8.27;
 /**
  * @title MathUtils Library
  * @notice A collection of functions to perform math operations
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library MathUtils {
     /**
diff --git a/packages/horizon/contracts/libraries/PPMMath.sol b/packages/horizon/contracts/libraries/PPMMath.sol
@@ -4,6 +4,8 @@ pragma solidity 0.8.27;
 /**
  * @title PPMMath library
  * @notice A library for handling calculations with parts per million (PPM) amounts.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library PPMMath {
     /// @notice Maximum value (100%) in parts per million (PPM).
diff --git a/packages/horizon/contracts/libraries/UintRange.sol b/packages/horizon/contracts/libraries/UintRange.sol
@@ -4,6 +4,8 @@ pragma solidity 0.8.27;
 /**
  * @title UintRange library
  * @notice A library for handling range checks on uint256 values.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library UintRange {
     using UintRange for uint256;
diff --git a/packages/horizon/contracts/staking/HorizonStakingBase.sol b/packages/horizon/contracts/staking/HorizonStakingBase.sol
@@ -21,6 +21,8 @@ import { HorizonStakingV1Storage } from "./HorizonStakingStorage.sol";
  * @dev Implementation of the {IHorizonStakingBase} interface.
  * @dev It's meant to be inherited by the {HorizonStaking} and {HorizonStakingExtension}
  * contracts so some internal functions are also included here.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract HorizonStakingBase is
     Multicall,
diff --git a/packages/horizon/contracts/staking/HorizonStakingStorage.sol b/packages/horizon/contracts/staking/HorizonStakingStorage.sol
@@ -15,6 +15,8 @@ import { LinkedList } from "../libraries/LinkedList.sol";
  * @notice This contract holds all the storage variables for the Staking contract.
  * @dev Deprecated variables are kept to support the transition to Horizon Staking.
  * They can eventually be collapsed into a single storage slot.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract HorizonStakingV1Storage {
     // -- Staking --
diff --git a/packages/horizon/contracts/staking/libraries/ExponentialRebates.sol b/packages/horizon/contracts/staking/libraries/ExponentialRebates.sol
@@ -9,6 +9,8 @@ import { LibFixedMath } from "../../libraries/LibFixedMath.sol";
  * @notice A library to compute query fee rebates using an exponential formula
  * @dev This is only used for backwards compatibility in HorizonStaking, and should
  * be removed after the transition period.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library ExponentialRebates {
     /// @dev Maximum value of the exponent for which to compute the exponential before clamping to zero.
diff --git a/packages/horizon/contracts/staking/utilities/Managed.sol b/packages/horizon/contracts/staking/utilities/Managed.sol
@@ -12,6 +12,8 @@ import { GraphDirectory } from "../../utilities/GraphDirectory.sol";
  * For Graph Horizon this contract is mostly a shell that uses {GraphDirectory}, however since the {HorizonStaking}
  * contract uses it we need to preserve the storage layout.
  * Inspired by Livepeer: https://github.com/livepeer/protocol/blob/streamflow/contracts/Controller.sol
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 abstract contract Managed is GraphDirectory {
     // -- State --
diff --git a/packages/subgraph-service/contracts/DisputeManagerStorage.sol b/packages/subgraph-service/contracts/DisputeManagerStorage.sol
@@ -5,6 +5,12 @@ pragma solidity 0.8.27;
 import { IDisputeManager } from "./interfaces/IDisputeManager.sol";
 import { ISubgraphService } from "./interfaces/ISubgraphService.sol";
 
+/**
+ * @title DisputeManagerStorage
+ * @notice This contract holds all the storage variables for the Dispute Manager contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
+ */
 abstract contract DisputeManagerV1Storage {
     /// @notice The Subgraph Service contract address
     ISubgraphService public subgraphService;
diff --git a/packages/subgraph-service/contracts/SubgraphServiceStorage.sol b/packages/subgraph-service/contracts/SubgraphServiceStorage.sol
@@ -3,6 +3,12 @@ pragma solidity 0.8.27;
 
 import { ISubgraphService } from "./interfaces/ISubgraphService.sol";
 
+/**
+ * @title SubgraphServiceStorage
+ * @notice This contract holds all the storage variables for the Subgraph Service contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
+ */
 abstract contract SubgraphServiceV1Storage {
     /// @notice Service providers registered in the data service
     mapping(address indexer => ISubgraphService.Indexer details) public indexers;
diff --git a/packages/subgraph-service/contracts/interfaces/IDisputeManager.sol b/packages/subgraph-service/contracts/interfaces/IDisputeManager.sol
@@ -4,6 +4,12 @@ pragma solidity 0.8.27;
 
 import { Attestation } from "../libraries/Attestation.sol";
 
+/**
+ * @title IDisputeManager
+ * @notice Interface for the {Dispute Manager} contract.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
+ */
 interface IDisputeManager {
     /// @notice Types of disputes that can be created
     enum DisputeType {
diff --git a/packages/subgraph-service/contracts/interfaces/ISubgraphService.sol b/packages/subgraph-service/contracts/interfaces/ISubgraphService.sol
@@ -14,6 +14,8 @@ import { LegacyAllocation } from "../libraries/LegacyAllocation.sol";
  * subgraph indexing and querying. The {SubgraphService} contract implements the flows described in the Data
  * Service framework to allow indexers to register as subgraph service providers, create allocations to signal
  * their commitment to index a subgraph, and collect fees for indexing and querying services.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 interface ISubgraphService is IDataServiceFees {
     /**
diff --git a/packages/subgraph-service/contracts/libraries/Allocation.sol b/packages/subgraph-service/contracts/libraries/Allocation.sol
@@ -6,6 +6,8 @@ import { Math } from "@openzeppelin/contracts/utils/math/Math.sol";
 /**
  * @title Allocation library
  * @notice A library to handle Allocations.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library Allocation {
     using Allocation for State;
diff --git a/packages/subgraph-service/contracts/libraries/Attestation.sol b/packages/subgraph-service/contracts/libraries/Attestation.sol
@@ -4,6 +4,8 @@ pragma solidity 0.8.27;
 /**
  * @title Attestation library
  * @notice A library to handle Attestation.
+ * @custom:security-contact Please email security+contracts@thegraph.com if you find any
+ * bugs. We may have an active bug bounty program.
  */
 library Attestation {
     /**
diff --git a/packages/subgraph-service/contracts/libraries/LegacyAllocation.sol b/packages/subgraph-service/contracts/libraries/LegacyAllocation.sol
diff --git a/packages/subgraph-service/contracts/utilities/AllocationManager.sol b/packages/subgraph-service/contracts/utilities/AllocationManager.sol
diff --git a/packages/subgraph-service/contracts/utilities/AllocationManagerStorage.sol b/packages/subgraph-service/contracts/utilities/AllocationManagerStorage.sol
diff --git a/packages/subgraph-service/contracts/utilities/AttestationManager.sol b/packages/subgraph-service/contracts/utilities/AttestationManager.sol
diff --git a/packages/subgraph-service/contracts/utilities/AttestationManagerStorage.sol b/packages/subgraph-service/contracts/utilities/AttestationManagerStorage.sol
diff --git a/packages/subgraph-service/contracts/utilities/Directory.sol b/packages/subgraph-service/contracts/utilities/Directory.sol
