Report it privately.
We answer in 48 hours

Email info@decentralchain.io and include as much of the following as you have. A partial report is still worth sending — do not wait until it is complete.

• The affected package or component, for example @decentralchain/transactions, a RIDE contract address, or the node itself.
• A description of the vulnerability.
• Steps to reproduce it.
• Your assessment of the potential impact.
• A suggested fix, if you have one. Optional.

These are commitments, not aspirations. If a deadline passes without contact from us, escalating publicly is reasonable.

• 48 hours — acknowledgement that a human has read it.
• 5 business days — assessment, including whether we agree on severity.
• 14 days — patch for a critical issue.
• 30 days — patch for lower severity.

Anything that can move value, halt the chain, or misrepresent state is in scope. That includes the node, the RIDE contracts deployed at published addresses, the Solana bridge, the published @decentralchain/* packages, and the Cubensis Connect extension.

Reports about this website matter less than reports about the chain, but send them anyway. The site holds no keys, sets no cookies, and runs no backend, so its blast radius is small by construction.

Publishing these costs us nothing and saves you the effort of reporting them. All of it is already documented in the repository.

• Bridge withdrawal works for seed accounts only. Ledger and Cubensis users cannot call burnToken yet, so a hardware-signed account cannot withdraw across the Solana bridge.
• BTC, cbBTC and BONK are registered but unusable on the bridge, and the interface filters them out rather than letting a transfer fail.
• SOL and JitoSOL carry 9 decimals on Solana and 8 here. Any integration assuming they match is wrong by a factor of ten.
• The AMM protocol fee does not actually skim. config:protocolFeePct is configured on chain, but the deployed PoolCore contract never reads it, so the burn sink is inactive.
• Mainnet HotStuff finality is unverified. T0 DeterministicFinality is the authoritative tier; plan against the 100-block max-rollback-depth rather than a faster assumption.
• One address currently produces 100% of blocks. Feature 14 needs 18,000 votes in a 20,000-block window, so that operator could activate block rewards unilaterally. The fixed supply is a governance commitment, not yet a technical guarantee.
• @decentralchain/transactions@5.0.0 does not import under Node ESM. Its protobuf-serialization dependency imports protobufjs/minimal without a file extension. Bundled builds resolve it; bare Node does not.

Every pull request runs GitHub's dependency-review-action, and every release generates an SBOM through anchore/sbom-action. If you integrate the packages, run pnpm audit before you ship, pin with a lockfile, and stay on Node 24 or later — the packages require it.

Five packages named in the monorepo are workspace-only and are not on npm: types, protobuf-schemas, node-api, data-service-client and @dcc-amm/sdk. A package appearing on npm under one of those names would not be ours, and is worth reporting.