> For the complete documentation index, see [llms.txt](https://docs.bloxchain.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bloxchain.app/security/audit-status.md). # Audit status What has been audited, where to read the report, and what that means for each surface you might use. ## Current status The **Bloxchain Protocol** core has completed a third-party security audit by Nethermind (engagement **NM\_0828**). The scope was the core framework library under `contracts/core/`. The Protocol is open source (MPL-2.0) with automated fuzz, invariant and integration test suites. The Protocol core is audited by Nethermind (NM\_0828), core framework scope. Custom extensions and your own configuration are not covered by that audit. The **Bloxchain Platform** at bloxchain.app is **Alpha · Testnet · Local-first**. It runs on Sepolia today, and Ethereum mainnet is coming soon. An audit of the core contracts does not make the Platform, your custom extensions or your operational setup ready for real value. ## Published reports | Report | Scope | Links | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Nethermind NM\_0828 | [`contracts/core/`](https://github.com/PracticalParticle/Bloxchain-Protocol/tree/99beac2d6e6d7567c23b25cecaf6f4053f31c987/contracts/core/), the core framework library | [Engagement page](https://github.com/PracticalParticle/Bloxchain-Protocol/blob/99beac2d6e6d7567c23b25cecaf6f4053f31c987/audits/nethermind/README.md) · [Report PDF](https://github.com/PracticalParticle/Bloxchain-Protocol/blob/99beac2d6e6d7567c23b25cecaf6f4053f31c987/audits/nethermind/Nethermind-Bloxchain-Core-NM_0828.pdf) | | Additional scopes | Added here if and when published | | The core change policy that governs what may change inside the audited scope: [AUDIT.md](https://github.com/PracticalParticle/Bloxchain-Protocol/blob/99beac2d6e6d7567c23b25cecaf6f4053f31c987/contracts/core/AUDIT.md). The links above are pinned to the release this documentation describes, which is not the same thing as the commit the auditors reviewed. The report names that commit. Anything under `contracts/core/` that changed after it falls outside the published report, so check the report's commit against the version you are running before you rely on the scope. Questions about scope or report availability: . ## What this means by surface | Surface | Audit status | What you should do | | ------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Protocol core** (`contracts/core/`) | Audited (Nethermind NM\_0828) | Deploy or import accounts from a tagged release. Verify addresses on an explorer. | | **Account templates and example factories** (AccountBlox, CopyBlox) | Built on the audited core; templates and examples were not in the NM\_0828 scope | Read the template source at the pinned commit. Official Sepolia addresses are listed on [Deploy the Protocol](/developers/deployment.md#official-sepolia-addresses). | | **SDK** (`@bloxchain/sdk`) | Client library, not part of the contract audit | Pin to the same release as the contracts. Keys and RPC security are yours. See [SDK setup](/developers/sdk-setup.md). | | **Bloxchain Platform** (bloxchain.app) | Alpha · Testnet · Local-first. Not audited as an application. | Use on Sepolia with test funds. Back up this device. Do not hold real value during alpha. | | **Your custom extensions** (custom contracts, factories, proxies) | Not audited | Commission your own review before any deployment that holds value. | ## Limits of the audit An audit reviews a defined scope at a point in time. It does not replace: * Your operational security: keys, runbooks, monitoring. * Review of custom contract code beyond the Protocol baseline. * Legal or regulatory classification of your use case. Assumptions and trust boundaries: [Security model](/security/security-model.md). Boundaries of the current release: [Known limitations](/security/audit-status/known-limitations.md). ## Before you hold value Work through [Production readiness](/developers/deployment/production-readiness.md) once mainnet deployments open. Until then, treat every account as a testnet account. ## Ongoing assurance * Vulnerabilities: [Report a vulnerability](/security/report-vulnerabilities.md). Do not use public issues. * Releases: [GitHub releases](https://github.com/PracticalParticle/Bloxchain-Protocol/releases) and [Releases and compatibility](/resources/releases.md). * Documentation changes: [Changelog](/resources/releases.md#changelog). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bloxchain.app/security/audit-status.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.