Security is not a feature — it is the foundation. Every line of code, every cryptographic primitive, every consensus rule must be verifiable and auditable.
The Omnia Protocol bug bounty program rewards security researchers who discover and responsibly disclose vulnerabilities. We believe that public scrutiny makes systems stronger, not weaker.
All Rust code in omnia-protocol repository
substrate/, zk/, binding/, shards/, economics/, node/, chaos-tests/
Solidity contracts
Smart contract code and deployment scripts
Cryptographic implementations
VRF, Poseidon, Groth16, Dilithium, ML-KEM, BLS12-381
Consensus mechanism
Causal graph, BFT finality, CRDT state convergence
Network protocol
libp2p transport, GossipSub, peer authentication
Consensus break, key theft, fund loss, ZK proof forgery
$10,000 – $50,000State corruption (non-exploitable), signature bypass, DoS bypass
$5,000 – $10,000Information leak, degraded performance, nonce reuse
$1,000 – $5,000Minor bugs, UX issues, doc errors with security implications
$100 – $1,000security@omnia-protocol.org
PGP Encryption
Please encrypt your report using our PGP key
Your report should include:
Acknowledgment
Within 24 hours
Initial Assessment
Within 72 hours
Fix Development (Critical/High)
Within 5 business days
Critical
7 days
High
14 days
Medium
30 days
Low
Next release
We follow a 90-day embargo policy. Vulnerabilities will not be publicly disclosed until a fix is available, or 90 days have elapsed since the initial report — whichever comes first. Extensions may be granted upon request.
Bounties are paid in USDC or USDT on Ethereum mainnet. Payment is processed after the fix has been verified and deployed. Researchers may choose to donate their bounty back to the protocol.
Security is not an afterthought. It is embedded into every stage of development — from dependency selection to deployment. Here is what we do, concretely.
cargo-vet, cargo-deny, and SBOM generation for all dependencies. Every crate is audited before inclusion.
Continuous monitoring of Rust Security Advisory Database with automated CI checks on every pull request.
Enforced across all crates — no unchecked unwraps in production code. All error paths must be explicit.
34 thiserror enums providing structured, typed error handling instead of string-based errors.
Dedicated side-channel audit for ZK and binding crates. Timing and memory access patterns are analyzed.
VRF and BLS operations are constant-time by design, preventing timing-based key recovery attacks.
Continuous code coverage tracking with enforcement thresholds on critical paths.
Transparency means showing the work. Here is the current state of our security audit findings — remediated and tracked.
High-priority findings remediated
Medium-priority finding remediated
Medium-priority findings tracked
External security audit
An external security audit is currently in preparation. Results and findings will be published in full upon completion. We do not hide audit results.