POST-QUANTUM PROTOCOL · SOLANA MAINNETProtected by 34-Chain SHA-256 One-Time Signatures (RFC 8554 LM-OTS) · Immutable Custody.Security boundaries
QUANTUMSAFE
Initialize Vault
Bug bountySolana Mainnet · RFC 8554 LM-OTS

It’s not a bug.It’s a bounty.

Quantum Safe holds real funds on Solana mainnet. All protocol source code and cryptographic test vectors are open. If you can break any security boundary, tell us first and get paid for it.

Report a vulnerabilityWhat counts
Secure the Quantum Safe1:11
QUANTUM SAFE · SECURITY BOUNDARY VERIFIER

Zero-Curve Custody Verification

Every instruction is validated against deterministic SHA-256 preimage commitments on Solana mainnet.

UPGRADE AUTHORITY
RENOUNCED (NONE)
ADMIN KEYS
0
TIMELOCK AIRLOCK
1H – 7D CONFIGURABLE
EMERGENCY CANCEL
INSTANT STOP-FILE
VERIFY[PDA] :: derive_qsafe_vault(owner_commitment, timelock_Policy) -> OK
VERIFY[LMOTS] :: sha256_chain_step(sig[0..1124], pub_root[32]) -> MATCH
VERIFY[EPOCH] :: rotate_generation_root(epoch + 1) -> COMMITTED
STATUS :: INVARIANT_HELD · ZERO_CURVE_EXPOSURE
01THE BOUNTY VAULT
In the vaultBalance unavailableThe bounty wallet’s address has not been published yet.The door is a picture from the film. The numbers are read from the network.
Where the money comes from

Funded by creator rewards from the Quantum Safe Mode coin ($QSAFE). Rewards flow into this wallet and pay for bug bounties and Quantum Safe’s development.

The coin is not an investment and doesn’t unlock anything in Quantum Safe. Nothing here is financial advice.

The figure is the SOL in the wallet plus the creator rewards it has earned and not yet claimed, read from the network while this page is open. It is not a promise of any payout.

02HOW TO REPORT

Five steps.
The second one is private.

Say which commit, how to reproduce it, and what it lets someone do. Leave out passwords, seed phrases and key files.

  1. 01

    Find it

    In the program, the site, the offline tool or the command-line client. All of it is open source.

  2. 02

    Report it privately

    Through GitHub’s private vulnerability report. Nobody else can read it.

  3. 03

    We confirm and fix

    We reproduce it, tell you what we found, and ship the fix.

  4. 04

    You get paid

    From the bounty vault, to the Solana address you give us.

  5. 05

    Public write-up

    After the fix has shipped, with your name on it if you want it there.

Report privately on GitHub
03 / THE RULES
  • Proof of concept only. Show that it works; don’t use it.
  • Never touch funds that aren’t yours.
  • Test on your own Quantum Safe, with small amounts.
  • No public disclosure before the fix ships.
04WHAT COUNTS

Four tiers,
by what it lets someone do.

Payout amounts have not been set yet. They will be written here, and nowhere else, when they are.

  1. CriticalPayout: TBD

    Funds leave a Quantum Safe without its owner’s keys, or its rules are bypassed.

    • Withdraw from a Quantum Safe you don’t control.
    • Reuse or forge a one-time-key signature.
    • Bypass the trusted addresses or the waiting period.
    • Read a recovery kit’s secret out of the offline tool.
  2. HighPayout: TBD

    An owner loses control of a Quantum Safe, or signs something they did not see.

    • Lock a Quantum Safe’s funds so its owner can never withdraw them.
    • Make the site, the offline tool or the command-line client sign something other than what it showed.
    • Take a day key or its password out of the site, for example by running your own script on qsafemode.io.
    • Cancel or block someone else’s withdrawal or recovery.
  3. MediumPayout: TBD

    A Quantum Safe is disrupted or misreported, and no funds move.

    • Stop one Quantum Safe from working for a while.
    • Make an alert miss a withdrawal, or report one that did not happen.
    • Show a wrong balance or a wrong state that could lead an owner to a bad decision.
  4. LowPayout: TBD

    A real flaw with no path to anyone’s funds.

    • A gap in the page’s security policy that cannot be used yet.
    • A check that is weaker than the documentation says.
    • Wording that would mislead a careful reader about what is protected.

Not covered: other people’s wallets and apps, Solana itself, sites pretending to be Quantum Safe, tricking a person rather than the software, and the coin. Already listed limits are on the security page; a way around one of them is still a finding.

05HALL OF FAME

The people who broke it first.

Nobody yet. The first name here could be yours.