← OBSIDIO.NETWORK

Bug Bounty.

TESTNET PROGRAM — rewards TBD until mainnet treasury

Report vulnerabilities in Obsidio L1/L2, wallets, bridge, FHE/STARK paths. Prefer responsible disclosure. See AUDIT_CHECKLIST.

In scope

Consensus / Dilithium QC bypass, double-finality
Winterfell proof forgery / soundness gaps
TFHE voting / lending tally manipulation
Bridge attestation or light-client spoofing
Wallet extension window.obsidio XSS / key theft
RPC auth bypass when OBSIDIO_RPC_API_KEY is set

Out of scope (for now)

Social engineering / phishing of users
DoS without novel amplification (rate limits exist)
Issues in third-party deps with public CVEs already filed upstream
Testnet faucet / demo “hints” that are intentional

How to report

Email security@obsidio.network (or open a private GH advisory when repo is public)
Include PoC, impact, affected RPC/method/version (obsidio_getStatus)
Allow 90 days before public write-up

Severity guide (provisional)

Critical — fund theft / consensus break
High — unauthorized mint / bridge drain
Medium — privacy break of FHE ballot / position
Low — info leak / auth footgun