height 23716 of 23716 on the network. 9 peer(s) connected, 77 in its peer directory; 1012 block(s) followed and 841 pulled in by sync since this follower started. Caught up: this follower holds every block any peer has claimed, so every panel below is the whole chain. Genesis 1cf8655125cc1bbb…, producers genesis.
What this follower is, locally
Following 7 seed(s) — their addresses are not published here, for the reason the peer table gives. Its store is held under its own Cerberus lease — no other node’s store is opened, touched or stopped.
Bug bounty
No reward, no severity scale and no payout has been authorised anywhere in this software, so this page promises none. Report a finding anyway — the route below is real and a security defect in a chain is worth reporting whether or not anybody is paying for it. What a programme would need before it could be announced is listed at the foot.
Until there is one, the position is simply stated: findings are welcome, they go to the address below, and nothing about a reward should be inferred.
How to report
- Where
- support@sourceless.net, which takes security findings along with everything else technical. There is no separate security mailbox and no PGP key published yet, so a finding that needs encrypting in transit should say so in a first message rather than be sent in the clear.
- What to include
- The exact version or commit, the surface or component, what you did, what happened, and what you expected. A reproduction somebody else can run is worth more than a description of a class of bug.
- Please do not
- Publish before somebody has had a chance to answer; test against a live network in a way that costs other people money or liveness; or use another holder’s account, domain or key to demonstrate something.
- What you will not get
- A promised response time. None is set, and a page that invented one would be the first thing a researcher found to be untrue.
What would be in scope
Stated from what this build contains rather than from a template, because a scope list naming components that do not exist is how a programme loses credibility in its first week:
- Consensus and the ledger. Anything that makes a node accept a block or a record it should refuse, that lets a balance change without an authorised signature, or that reorganises something at or below the finality line.
- Identity. Anything that lets a name, a wNFT or a spending authority be taken, forged or used by somebody who does not hold the key.
- Cryptography and keys. Anything that weakens a signature, a key derivation or a recovery path, or that leaks key material.
- The public surfaces. This explorer, the node’s JSON-RPC door and the wallet. On this surface specifically: anything that gets markup or script past the escaping, anything that discloses a host path, a peer address or an operator credential, and anything that lets an unauthenticated request make a node do unbounded work.
Two things are deliberately NOT presented as findings. A route that refuses to serve something is usually doing its job — this surface answers GET and HEAD only and clamps every page — and exhausting one node by sending it enough traffic is a property of running a public endpoint rather than a defect in the chain.
What exists instead of a bounty, today
The repository keeps a published audit record: dated audit documents stating what was examined, by what method, what was found, what was fixed and what is still open. It also carries a gate suite that re-reads the documentation’s own claims against the code, so a sentence in a document that stops being true fails a check rather than sitting there. Neither is a substitute for an outside researcher, which is why this page is here at all.
Not answered here
Each of these is a decision rather than a measurement, so nothing in this build could supply one. They are listed here, and again at the JSON mirror of this page, rather than filled with something that would read as true.
- [WHETHER A FUNDED PROGRAMME WILL EXIST AT ALL — to be supplied]
- [THE SEVERITY SCALE, AND A REWARD RANGE FOR EACH LEVEL — to be supplied]
- [WHAT A REWARD WOULD BE PAID IN, AND BY WHOM — to be supplied]
- [A DEDICATED SECURITY ADDRESS AND A PGP KEY — to be supplied]
- [TRIAGE AND RESPONSE TARGETS — to be supplied]
- [SAFE-HARBOUR WORDING: WHAT TESTING IS AUTHORISED — to be supplied]
- [COORDINATED DISCLOSURE WINDOW BEFORE PUBLICATION — to be supplied]
- [WHETHER FINDINGS WILL BE CREDITED PUBLICLY, AND HOW — to be supplied]
- [WHICH DEPLOYED HOSTS, IF ANY, MAY BE TESTED AGAINST — to be supplied]