git / moonbite-network / SECURITY.md · raw

# Security policyMoonBite is a live proof-of-work network, so a security bug can cost real people real coins. Report it privately, give us time to fix it, and we will credit you.## Reporting a vulnerabilityEmail **security@moonbite.org**. Please do not open a public issue or post about it until a fix has shipped.Include:- what is affected (node, miner, wallet, website, API) and which version or commit;- steps to reproduce, or a proof of concept;- what an attacker could do with it (steal coins, split the chain, crash nodes, read data).What to expect:- an acknowledgement within 7 days;- a fix or a mitigation plan agreed with you, normally within 30 days, sooner for anything that puts coins at risk;- credit in the release notes, unless you prefer to stay anonymous.There is no paid bounty programme yet.## Scope**In scope**- The MoonBite node: consensus rules, RandomX proof of work, P2P and RPC (a Litecoin Core v0.21.5.5 fork).- The miner scripts and download bundles in [`release/miner/`](release/miner/).- moonbite.org: the website, block explorer, wallet pages and merchant API ([`web_app.py`](web_app.py)).- The desktop and mobile wallets.- The seed nodes and release pipeline ([`deploy/`](deploy/)).**Out of scope**- Volume denial-of-service against public endpoints (rate limits are known and intended).- Social engineering, phishing or physical attacks.- The Python files and `.bat` launchers at the repository root. They are an old educational reference implementation, not the MoonBite network.- The 51% risk described below, which is already public.## Known risksThese are known and disclosed. You do not need to report them, but ideas to reduce them are welcome.| Risk | Status || --- | --- || **Low hashrate.** Total hashrate is a few kH/s, most of it from the founder ([ADR-006](docs/ADR-006-founder-mining-disclosure.md)). Anyone with modest CPU power could out-mine the network and reorganise recent blocks. | Open. Wait for many confirmations before treating a large payment as final. || **No independent audit.** Internal audits only (below). | Open. || **Release signing.** Releases publish SHA-256 hashes and are built reproducibly, but the minisign signing key is not set up yet, so hashes prove integrity, not who published them. | Open. || **Two seed nodes**, run by the same operator. | Open. More community nodes are welcome. |## Verifying releases- Compare every download against `SHA256SUMS.txt` from moonbite.org. The miner also prints the hash of the binaries it is about to run.- Rebuild and compare: [`docs/REPRODUCIBLE-BUILDS.md`](docs/REPRODUCIBLE-BUILDS.md).- The miner never installs itself, adds startup entries or asks for admin rights ([`release/miner/ANTIVIRUS.md`](release/miner/ANTIVIRUS.md)).## Past internal audits| Date | Report || --- | --- || 2026-10-09 | [Whole-infrastructure audit](AUDIT_INFRA_FULL_2026-10-09.md) || 2026-10-09 | [Bug bounty, mainnet and wallet](AUDIT_BUG_BOUNTY_2026-10-09.md) || 2026-10-09 | [Fork delta vs upstream Litecoin](AUDIT_FORK_DELTA_2026-10-09.md) || 2026-10-09 | [Live chain](AUDIT_LIVE_CHAIN_2026-10-09.md) || 2026-10-03 | [Backdoor hunt, pass 2](AUDIT_BACKDOOR_HUNT_2026-10-03_PASS2.md) |## Safe harbourGood-faith research that follows this policy is welcome. We will not pursue legal action for it. Please:- test on testnet or regtest, or against your own node, wherever you can;- never take or move coins that are not yours;- never access other users' data beyond what is needed to show the problem;- avoid degrading the network or website for others.