BLACKCOIN / PROTOCOL V4SECURITY

SECURITY / REPORT PRIVATELY

Verify releases. Report vulnerabilities privately.

For a suspected vulnerability in Blackcoin Core, this website, or a public Project Blackcoin service, email [email protected] or use the repository's private security-advisory flow ↗. Do not open a public issue containing an unpatched vulnerability, private key, wallet file, seed phrase, credential, or private infrastructure detail.

Ordinary bugs and feature requests belong on the public issue tracker ↗. Email is not represented as end-to-end encrypted and no project OpenPGP key is published; use a private GitHub advisory for reports that should not travel in ordinary email.

CLAIM RECOVERY / RELEASE HISTORY & CURRENT SCOPE

The #37 claim-family recovery work shipped in 30.1.5. Authenticated same-anchor continuation and explicit, separately authorized fee-paying recovery replace the older blanket paused-miner guidance. Retained signed claims can still confirm outside the local mempool, so their anchors remain reserved until chain state or an authorized recovery spend resolves them. The published 30.1.5.1 release completes issues #54–56, correcting additional retained-history and larger-wallet capacity limits; review the completion evidence and upgrade guide for the final signed source and publication receipt. No release is a claim that all possible defects are eliminated. Read issue #37 ↗

Current release boundary

  1. Use an exact published record. The validated release catalog lists platform artifacts and their verification files. A preparation PR, unpublished canary, or installed node version does not establish public release status.
  2. Source identity is not package code signing. Verify the exact Git source commit and tag signatures. Windows packages lack Authenticode signatures. macOS apps use ad-hoc signatures and are not Developer ID signed or notarized.
  3. Verify before execution. Check the exact source identity, SHA-256 manifest, SPDX SBOM, provenance/evidence records, and unsigned-package notices from the release record. These controls improve traceability; they are not an independent security audit or certification.
  4. Preserve wallet recovery material. ML-DSA quantum keys are non-HD and are not derived from the wallet seed. Back up the wallet after every new quantum address or key. Never send wallet backups or private keys with a vulnerability report.
  5. Respect the accounting boundary. Gold Rush Protocol V4 credits are synthetic, non-Merkle, and phase-locked. During Gold Rush they are not spendable BLK, exchange deposits, withdrawals, or circulating supply.

What to include in a private report

  1. The affected release, exact source commit, operating system, and deployment mode.
  2. Minimal reproduction steps, expected behavior, and observed behavior.
  3. Sanitized logs or a minimal test fixture with credentials and wallet data removed.
  4. Whether the issue is currently exploitable and whether public disclosure has occurred.

No response time, bounty, safe-harbor determination, or remediation date is promised on this page. Coordinate disclosure privately before publishing technical details.