Secure by design. Verified by others.
How we protect the network and its users: independent audits, an open bug bounty, safe upgrade practices and responsible disclosure.
Independent reviews.
Every custom module is audited before mainnet. Final reports, including findings and fixes, are published here in full.
| Scope | Auditor | Status | Report |
|---|---|---|---|
| Custom modules: x/standby, x/burn, x/blacklist | Coming soon | Scheduled · Phase 3 | — |
| Inflation, commission guard and ante handlers | Coming soon | Scheduled · Phase 3 | — |
| Genesis file and launch configuration | Coming soon | Planned | — |
| Upstream: Cosmos SDK, CometBFT, Cosmos EVM | Maintainers and third parties | Public | Upstream reports |
Find a bug. Get paid.
The program covers the cockroachd node, custom modules, precompiles and official websites. Rewards are paid in COCKROACH or stablecoins after the fix ships.
| Severity | Examples | Reward |
|---|---|---|
| Critical | Loss or theft of funds, unauthorized minting, consensus halt, bypass of the commission or freeze rules | Coming soon |
| High | Chain halt that needs a coordinated upgrade, permanent freezing of funds, validator set manipulation | Coming soon |
| Medium | Temporary denial of service, incorrect reward accounting, RPC crashes | Coming soon |
| Low | Issues with limited impact and clear mitigations | Coming soon |
Disclose responsibly.
Please do
Report privately to contact@cockroachchain.com with steps to reproduce. Give us reasonable time to fix before any disclosure. Test only on devnet, testnet or your own nodes.
Please don’t
Exploit a bug beyond proof of concept, access other users’ data or funds, run denial-of-service attacks on public infrastructure, or use social engineering.
How we keep the chain safe.
Open source
All code is public so anyone can review it.
Governed upgrades
Upgrades need an on-chain vote and run at a set block height.
No admin keys
No one can move user funds. Freezes need a governance vote.
Sentry architecture
Validator guides require sentry nodes and remote signers.
Monitoring
Network health and validator uptime are tracked around the clock.
Post-mortems
Every incident is written up publicly within 72 hours.
Found something?
Write to us with “Security report” in the subject. We reply within 48 hours.