Report it privately. Review it openly.
QSDM's security review is open and community-led: anyone may read the code, rebuild the release and report what they find, with a bug bounty paid in CELL. This is not an independent audit, and no independent audit of QSDM has been completed. A professional audit remains welcome.
Confirmed by the owner on 17 October 2026. The reward tiers on this page and a total pool of 50,000 CELL are confirmed; the full terms are in the bug bounty policy. No bounty has been paid yet.
How to report
Use the contacts in security.txt. Never open a public issue, pull request or post about an unfixed vulnerability.
- Preferred: a private GitHub security advisory (external site) on the QSDM repository.
- If you cannot use GitHub: email admin@qsdm.tech. Email is not encrypted, so send a short description first, without exploit details or keys, and we will set up a private advisory with you.
Include the component, the version or release, the impact, the severity you propose, step-by-step reproduction on a local node, a CELL address for a possible reward, and how you want to be credited.
Rewards (50,000 CELL pool)
Severity follows the impact you demonstrate on the live network's configuration, using a CVSS-like rubric.
| Critical |  up to 20,000 CELL Forged or unsigned blocks accepted by followers, a chain fork, a double spend, CELL minted above the schedule or the 90,000,000 CELL cap, an ML-DSA-87 signature forgery that moves someone else's CELL, or remote extraction of the producer key. |
|---|---|
| High | up to 5,000 CELL Stealing another miner's reward, a proof paid twice, unpaid or duplicate edge settlement through a relay, a crafted request that halts block production, an anonymous client tripping a mining latch, or a tampered binary passing release verification. |
| Medium | up to 1,000 CELL A temporary node or API stall from cheap requests, an enrollment-bond bypass, invalid transfer parents accepted without a double spend, or a leak of private configuration. |
| Low | up to 100 CELL Minor information leaks, a service on a wider interface than intended, or a security-relevant documentation error. |
- Confirmed. The tiers and a total pool of 50,000 CELL were confirmed by the owner on 17 October 2026. If the pool runs out, the program pauses with notice.
- Never minted. Rewards are paid from the owner's own mined CELL by an ordinary signed transfer. The bounty does not change the supply, the emission schedule or the cap, and there is no treasury.
- First reporter. The first report we can reproduce gets the reward; later reports of the same root cause are duplicates.
- No promised value. CELL on the pilot network has no promised value, and a reward is not an investment.
Scope
The full table, with what is out of scope for each component and the known issues, is in the bug bounty policy.
| Consensus | Block, vote, certificate and evidence signatures (ML-DSA-87); the producer allowlist and transition; height-gated rules; anything that forks honest nodes. |
|---|---|
| Supply and mining rewards | The mining admission guard, payout ledger and its invariants, crash recovery, the emission schedule and the 90,000,000 CELL cap. |
| Mining protocol v2 | Proof verification, NVIDIA attestation (QSDM mining supports NVIDIA GPUs only), enrollment and the 10 CELL bond. |
| Wallets | ML-DSA-87 signing and verification, nonces and replay, keystores, recovery phrases, account login, qsdmcli, and key handling in the web wallet and Hive. |
| Transfers | Proof-of-Entanglement parent rules. |
| Edge relay settlement | Settlement proofs, the relay-only rule, receipts and the reward split. |
| Node and API | Write-allowlist bypass, crashes from small crafted requests, key or configuration leaks. |
| Releases | Reproducible builds, checksums and release verification. |
| Out of scope | Censorship by the single producer (a known pilot limit), volumetric DoS, social engineering, physical attacks, third-party services, scanner output without impact, and the dashboard, bridge and contract code that is not active. |
Rules of engagement
- Use a local node. Reproduce every exploit on your own node or local network. The community review page shows how to build the exact binary the network runs.
- Never touch other people's funds or data. Do not move, freeze or spend CELL you do not own, or use other people's keys, wallets, accounts or mining identities.
- No denial of service against the live network. Do not flood or crash the live producer, the public API, the website or the backup node.
- No live exploitation of mining or settlement. Do not send forged or replayed proofs, enrollments or settlements to the live network.
- Ordinary use is fine: normal-rate reads of the public API and ordinary transactions from your own wallets.
- No social engineering, phishing or physical attacks, and no attacks on third-party services.
Safe harbour
If you make a good-faith effort to follow these rules, we consider your research authorized. We will not bring or support legal action against you for it, including under computer-misuse laws or our terms of use, and we will not report you to law enforcement for it. If someone else takes action over research you did under this policy, we will say publicly that it was authorized.
This covers QSDM's own systems and code only. It cannot bind third parties and is not legal advice. If you are unsure whether something is allowed, ask privately first.
Response and disclosure
| Acknowledgement | Within 72 hours |
|---|---|
| Severity confirmed | Within 7 days |
| Fix, Critical and High | Aim for 14 days, or a documented mitigation |
| Public disclosure | 90 days after the report, or earlier once a fix is released and operators have upgraded. Extensions are agreed with the reporter. |
| Payout | After the fix ships, as a signed CELL transfer, recorded in the public review log with your consent |
Community review
The community review publishes the review scope (consensus, wallet signatures, mining rewards and supply, enrollment, edge settlement, Proof-of-Entanglement, task actions and release provenance), instructions to rebuild the release bit for bit, a checklist per component and a public review log.
It replaces a paid audit firm for now. It is not an independent professional audit: reviewers are not hired or supervised, coverage is not guaranteed, and nobody signs off on the result. The public audit checklist is a separate, self-maintained list.
Acknowledgments
Reporters who agree to be named are listed here and in the review log. No reports have been acknowledged yet.
Published security advisories: GitHub security advisories (external site).