Security
Found a problem? Tell us privately first.
Report a vulnerability to us before sharing it publicly, so it can be fixed first. We test in the open and publish what we find, including failures.
security@onexsmartchain.com- No paid external audit yet. Internal tests and their results are published as they happen.
- Failures stay on record. A later pass is added as new evidence, never as a rewrite.
- Mainnet launches without sudo or any admin key.
- A bug bounty opens with the public testnet.
Security policy
How to report
Email security@onexsmartchain.com. Please include:
- what is affected (runtime, node, RPC, explorer, website);
- steps to reproduce, or a proof of concept;
- the impact you expect;
- how we can reach you for questions.
Please
- Give us reasonable time to fix the issue before you publish it.
- Test only on your own local network or on the public testnet once it opens. Do not attack other people's nodes, wallets or funds.
- Do not access, change or delete data that is not yours.
What we do
- We confirm we received your report.
- We keep you informed while we work on a fix.
- With your permission, we credit you when the fix is published.
Current status
- OneX has not had a paid external audit yet. Internal test results are published, including failures.
- There is no bug bounty yet. It opens with the public testnet.
- Mainnet will launch without sudo or any admin key.