Agent index (llms.txt) — fetch this first, then the page it names.
Security disclosure and bounty policy
This page sets out the scope, the severity ratings and the disclosure rules for vulnerabilities in the Orama chain and its global services. It does not promise a payout: amounts are the owner's to set and are published separately.
The project intends standing bounties on the chain, sized to pool value and staked value, and pre-mainnet costs, bounties included, are paid by the owner. No programme exists yet: there is no amount, no funding source, no schedule and no payer of record. So this page sets no amount and names no budget. It says what is in scope, how findings are rated and how to report one. The owner decides whether a given finding is paid and how much.
No audit of the chain has been done. Reports are welcome before one.
How to report
Do not open a public issue. Email security@debros.io. Include:
- +the commit or release,
- +the module,
- +what you did and what happened,
- +a test or transcript that reproduces it.
Test only on a chain you run yourself (chain/scripts/localnet in the repository) or on a devnet or stagenet you have permission for. Never test against someone else's node or user data.
This page makes no legal commitment.
What is in scope
- +
chain/: every module (x/emission,x/fees,x/power,x/houses,x/nodes,x/storage,x/relay,x/archive,x/token,x/cnft,x/market,x/wasmpolicy,x/inclusion,x/shielded,x/confidential), the app wiring, the ante handlers and bank send restrictions inchain/app, andoramad. - +The genesis parameter lock (
app.ValidateLockedGenesis) andoramad genesis validate. - +
piece/(underchain/), and the global servicesorama-global(provider, repair delegate, archiver, indexer). - +Release verification:
core/pkg/releaseverify,core/pkg/archivetrust, andorama maint global stage-oramad. - +The confidential-node boundary: any path that treats a quote, report or blob as a valid attestation is in scope and is rated Critical.
What is out of scope
- +The declared trust points of the security model. That the bootstrap committee decides before lambda reaches 1, that release signers choose what validators can install, that directory authorities and relay reporters are trusted until a majority is independent, and similar, are known and documented. A way to exceed them is in scope.
- +Findings that need a majority of voting power, or an operator's own root access to their own machine.
- +Volume attacks (flooding, resource exhaustion by sheer traffic) with no protocol flaw behind them.
- +Upstream bugs in Cosmos SDK, CometBFT, wasmd or wasmvm, Kubo, Tor, go-tuf or the Zcash crates that this repository does not change. Report those upstream. A way this repository's use of them is exploitable is in scope.
- +Placeholder economics recorded as the "G1 launch default" in the genesis parameters, unless the number lets a fake identity earn more than it costs or breaks an invariant.
- +The stagenet test release root, test keys, and any
-localnet-,-devnet-or-stagenet-genesis. - +Social engineering, and physical access.
Severity
The chain has no admin key, pause, freeze or upgrade authority to fall back on, and a state-machine fix is a coordinated halt-height fix. Severity follows what an attacker gains and how hard it is to undo.
| Severity | Examples |
|---|---|
| Critical | Minting norama outside the emission schedule. Creating or moving funds from any module account without the module's rule. Any key, message or path that pauses, freezes, blacklists, halts or upgrades the chain, or changes an ossified rule. A shielded bundle accepted without two independent verifiers, an unshield that breaks the turnstile or the 2% cap, or a double-spend of a nullifier. Treating any quote or blob as a valid TEE attestation, or any way to make a marketplace lease go through. Splitting consensus or halting the chain without more than a third of voting power. Forging a release the node's verifier accepts. |
| High | Breaking an invariant that oramad query <module> invariants checks. Governance passing without its opening rule, its votes or its timelock, or a house-bond escape. Paying a module account with a bank message, which would unbalance the earnings or deposit ledgers. Bypassing the upload allow-list or sunset. Drawing protocol payments for work not done, or storage or relay payments beyond the ceiling. A validator-set or power computation that can be biased by a non-validator. |
| Medium | A path that lets an attacker cheaply grief one operator or deal (a slash, jail or eviction they did not earn). A leak that narrows privacy without breaking a proof. An error that halts one node's block processing but not the chain. A parameter accepted outside its coded bound. |
| Low | Hardening gaps, misleading errors or docs that could lead an operator to a wrong action, and issues with no realistic exploit. |
Handling
- +The reporter sends the finding privately. It is acknowledged, then reproduced.
- +A finding that changes the state machine is fixed through the coordinated halt-height procedure. Nothing is patched on one node, and validators choose whether to run the fix.
- +The finding is made public after validators holding two thirds of voting power have had the fix staged, or immediately when no state-machine change is needed. The reporter is credited unless they ask not to be.
- +The owner decides, per finding, whether a payout is made and how much. A reporter should not expect one until the owner has published a programme with amounts.