Audit status
What has been audited, where to read the report, and what that means for each surface you might use.
Current status
The Bloxchain Protocol core has completed a third-party security audit by Nethermind (engagement NM_0828). The scope was the core framework library under contracts/core/. The Protocol is open source (MPL-2.0) with automated fuzz, invariant and integration test suites.
The Protocol core is audited by Nethermind (NM_0828), core framework scope. Custom extensions and your own configuration are not covered by that audit.
The Bloxchain Platform at bloxchain.app is Alpha · Testnet · Local-first. It runs on Sepolia today, and Ethereum mainnet is coming soon. An audit of the core contracts does not make the Platform, your custom extensions or your operational setup ready for real value.
Published reports
Additional scopes
Added here if and when published
The core change policy that governs what may change inside the audited scope: AUDIT.md.
The links above are pinned to the release this documentation describes, which is not the same thing as the commit the auditors reviewed. The report names that commit. Anything under contracts/core/ that changed after it falls outside the published report, so check the report's commit against the version you are running before you rely on the scope.
Questions about scope or report availability: security@particlecs.com.
What this means by surface
Protocol core (contracts/core/)
Audited (Nethermind NM_0828)
Deploy or import accounts from a tagged release. Verify addresses on an explorer.
Account templates and factories (BasicFactory, BasicAccount, and the Sepolia developer toolkit CopyBlox, AccountBlox)
Built on the audited core; templates and factories were not in the NM_0828 scope
Read the source at the release you use. Official addresses are listed on Deploy the Protocol.
SDK (@bloxchain/sdk)
Client library, not part of the contract audit
Pin to the same release as the contracts. Keys and RPC security are yours. See SDK setup.
Bloxchain Platform (bloxchain.app)
Alpha · Testnet · Local-first. Not audited as an application.
Use on Sepolia with test funds. Back up this device. Do not hold real value during alpha.
Your custom extensions (custom contracts, factories, proxies)
Not audited
Commission your own review before any deployment that holds value.
Limits of the audit
An audit reviews a defined scope at a point in time. It does not replace:
Your operational security: keys, runbooks, monitoring.
Review of custom contract code beyond the Protocol baseline.
Legal or regulatory classification of your use case.
Assumptions and trust boundaries: Security model. Boundaries of the current release: Known limitations.
Before you hold value
Work through Production readiness once mainnet deployments open. Until then, treat every account as a testnet account.
Ongoing assurance
Vulnerabilities: Report a vulnerability. Do not use public issues.
Releases: GitHub releases and Releases and compatibility.
Documentation changes: Changelog.
Last updated
Was this helpful?