Stay safe

Security & Trust

How to verify Punch on Sol is legitimate, our responsible-disclosure policy, and how to report anything suspicious you see.

Verify you're in the right place

We will only ever publish from these official channels. Anything else claiming to be us is fake.

Official $PUNCH contract address

A6KhmiFZN9aM7VkBTVp4FzNy9bCo2Jp63R9DphAW1VRQ

What we will never do

  • Ask for your seed phrase, private key, or to "validate" your wallet.
  • DM you first, ever. We don't initiate DMs.
  • Ask you to sign a message, approve a token, or send a transaction on this site.
  • Run giveaways that require you to "send first to receive more."

Responsible disclosure policy

We welcome reports from security researchers and community members. If you've found a vulnerability in this site, please:

  1. Report it privately by DMing @punch_on_sol on X.
  2. Give us a reasonable window to fix the issue before public disclosure (we aim for < 14 days for critical issues).
  3. Do not access, modify, or destroy data that doesn't belong to you.
  4. Do not run automated scanners or denial-of-service tests against the live site.

In return, we'll acknowledge your report, work on a fix in good faith, and credit you publicly if you'd like.

We don't currently run a paid bug bounty; this is a community memecoin project.

Report suspicious activity

Spotted a phishing site, fake $PUNCH token, impersonation, or scam DM in our name? Send us a heads-up via X or our Telegram.

Live system status: /status