BLACKCOIN / PROTOCOL V4SECURITY

SECURITY / REPORT PRIVATELY

Verify releases. Report vulnerabilities privately.

For a suspected vulnerability in Blackcoin v30.1.3, this website, or a public Project Blackcoin service, email [email protected] or use the repository's private security-advisory flow ↗. Do not open a public issue containing an unpatched vulnerability, private key, wallet file, seed phrase, credential, or private infrastructure detail.

Ordinary bugs and feature requests belong on the public issue tracker ↗. Email is not represented as end-to-end encrypted and no project OpenPGP key is published; use a private GitHub advisory for reports that should not travel in ordinary email.

KNOWN ISSUE / V30.1.3

Gold Rush PoW claim recovery issue #37 is public and high priority. In v30.1.3, a wallet-authored claim that leaves the local mempool remains quarantined and its input stays reserved because another peer may still confirm it. The current manual recovery RPC can refuse a claim family when multiple quarantined sibling claims spend the same input, leaving the wallet's built-in miner paused. The issue changes no consensus rule; native claim-family recovery, automation, and regression evidence remain pending. Review the live issue status and operator guidance before running Gold Rush PoW mining. Read issue #37 ↗

Current release boundary

  1. Supported public production record. The current release is v30.1.3 ↗, source commit 86c6855ab135afe784635a564f21c74d67aa366b.
  2. Source identity is not package code signing. The v30.1.3 source commit and tag are SSH-signed by Blackcoin-Dev. Packaged binaries are not Authenticode-signed, signed with an Apple Developer ID, or notarized.
  3. Verify before execution. Check the exact source identity, SHA-256 manifest, SPDX SBOM, provenance/evidence records, and unsigned-package notices from the release record. These controls improve traceability; they are not an independent security audit or certification.
  4. Preserve wallet recovery material. ML-DSA quantum keys are non-HD and are not derived from the wallet seed. Back up the wallet after every new quantum address or key. Never send wallet backups or private keys with a vulnerability report.
  5. Respect the accounting boundary. Gold Rush Protocol V4 credits are synthetic, non-Merkle, and phase-locked. During Gold Rush they are not spendable BLK, exchange deposits, withdrawals, or circulating supply.

What to include in a private report

  1. The affected release, exact source commit, operating system, and deployment mode.
  2. Minimal reproduction steps, expected behavior, and observed behavior.
  3. Sanitized logs or a minimal test fixture with credentials and wallet data removed.
  4. Whether the issue is currently exploitable and whether public disclosure has occurred.

No response time, bounty, safe-harbor determination, or remediation date is promised on this page. Coordinate disclosure privately before publishing technical details.