Official BasicFactory and BasicAccount addresses are published for 10 live networks and 6 testnets in official-deployed-addresses.json, including Ethereum mainnet. The Nethermind audit covers contracts/core/ only.

We actively maintain security updates for the following versions:

Core smart contracts (contracts/core/): Independently audited by Nethermind (audit index, report PDF, core policy). The audit applies to the commit recorded in audits/nethermind/README.md (see the report PDF for the exact SHA). Later changes to core are outside that report until a re-audit or addendum.

Examples and application code under contracts/examples/ are not covered by that engagement.

⚠️ IMPORTANT: Do NOT create public GitHub issues for security vulnerabilities.

Please report security vulnerabilities through one of the following channels:

Primary Contact:

• Email: security@particlecs.com
• Subject: [SECURITY] Bloxchain Protocol Vulnerability Report

Alternative Contact:

• Company Website: https://particlecs.com/contact
• Reference: "Security Vulnerability Report - Bloxchain Protocol"

When reporting a security vulnerability, please include:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact assessment
4. Suggested remediation (if any)
5. Your contact information for follow-up

We take security seriously and commit to the following response times:

• Initial Response: Within 24 hours
• Status Update: Within 72 hours
• Resolution: Within 7 days (for critical issues)
• Public Disclosure: Coordinated with reporter (typically 30-90 days)

Our State Abstraction framework implements multiple layers of security:

• Time-locked operations prevent immediate exploitation
• Request/approval workflows ensure proper authorization
• Mandatory multi-signature requirements eliminate single points of failure

• EIP-712 compliant meta-transaction signatures
• Nonce-based replay attack prevention
• Role separation between signing and execution

• Dynamic RBAC with runtime permission updates
• Function-level granular control
• Protected system roles that cannot be modified

• Always use the latest supported version of our contracts
• Implement proper access controls using our RBAC system
• Follow our secure development guidelines
• Test thoroughly using our provided test suites
• Pin releases and verify them against the audited core commit before production use

• Start with contracts/core/AUDIT.md and the Nethermind report
• Review TECHNICAL_OVERVIEW.md and the EngineBlox library
• Verify multi-signature workflow implementations
• Check meta-transaction signature validation

• Nethermind (core): Completed — see audits/nethermind/
• Internal security review: Ongoing with releases
• Code review: Human GitHub Approve on protected-branch merges (including Release Please); see CONTRIBUTING.md — Branch protection
• Supply-chain posture: OpenSSF Scorecard workflow on main (.github/workflows/scorecard.yml); Foundry fuzz/invariant suites under test/foundry/ (Scorecard’s Fuzzing check does not detect Foundry — local/CI fuzz remains the source of truth)

1. Immediate Assessment: Evaluate severity and impact
2. Coordinated Response: Work with reporter on timeline
3. Patch Development: Create and test security fixes
4. Deployment: Deploy updates to supported networks
5. Communication: Notify users of security updates
6. Documentation: Update security documentation

• GitHub Security Advisories: For public disclosure
• Email Notifications: For registered users
• Documentation Updates: In our security docs
• Social Media: For critical issues

Particle Crypto Security

• Website: https://particlecs.com
• Security Email: security@particlecs.com
• General Contact: https://particlecs.com/contact

We appreciate the security research community's efforts to help keep Bloxchain Protocol secure. All responsible disclosures will be acknowledged in our security advisories.

This security policy is subject to updates. Please check back regularly for the latest information.

Last Updated: June 2026