Security
Reporting a vulnerability
Email security@aevachain.com with a description, the affected component (chain, EVM facade, indexer, explorer, faucet, app, infrastructure) and steps to reproduce. Please do not open a public issue or post details until the problem is fixed.
We acknowledge reports and keep you informed while we work on them. There is no bug bounty programme on testnet-0.
The same contact is published as
/.well-known/security.txt
(RFC 9116) on every Aeva service.
What testnet-0 is, and is not
- Test tokens have no value. Never send real assets to an Aeva address, and never enter a mainnet seed phrase into anything that asks for it on testnet-0.
- The validator set is operated by the Aeva team (four validators at genesis). The chain’s safety rests on those operators.
- The code has not been audited. Testnet-0 is where it is exercised in public.
- The source repository is not public yet. Release binaries are published with their SHA-256 sums and a signature of the sums (see Releases).
- Hardware wallets are not supported yet (see Wallets).
What the chain checks for you
- Conservation of every right kind, and the consistency of every lock, pool and escrow: by the chain itself every 100 blocks from running sums and every 1 000 blocks by a full scan (a violation halts the chain), and every block by the indexer (see Conservation).
- Every transfer, wherever it comes from — native message, settlement, exercise or EVM — goes through the same status, lock and policy checks.
Last updated