SECURITY · CONFIRMED FINDINGS · CREDITED

The advisory register.

Every confirmed external finding against BlazePhoenix contracts gets a permanent number here — BPX-YYYY-NNN, never reused — once it is fixed, documented with its bound, or acknowledged. Summaries are results-level by policy: what was found and what was done. The deep technical registers live in the repositories; the credit lives here, with the researcher's permanent profile. A protocol that numbers its findings is one you can audit by list instead of by rumour.

BPX-2026-005acknowledgedstaking2026-08-17
Wei-scale rounding remainder
credited: siam siddik
BPX-2026-004fixedstaking2026-08-19
Staking-path finding (third bounty wave, T2)
credited: Thomas
BPX-2026-003fixeddex2026-08-19
Router-path finding (third bounty wave, T1)
credited: Thomas
BPX-2026-002documentedstaking2026-08-17
Stale weight read in a narrow window
credited: auditor_1b3f2c
BPX-2026-001fixedstaking2026-08-17
Dust-scale seat accounting defect
credited: auditor_1b3f2c

The people behind the register

Ranked researcher profiles live at /security/researchers — every credited handle has a permanent, linkable page. Found something? The bounty is open ›