Security
Security and responsible disclosure
Report a vulnerability and we will acknowledge it within one working day, keep you informed, and pay for findings that matter.
Scope
| In scope | Covers |
|---|---|
| marketplace.cmxofficial.com and engine.cmxofficial.com | Web, API, passports, verify, data room access control |
| Contracts listed on the official contracts page | AnchorRegistry, IdentityRegistry, CMX-U, factory, DpuRegistry, EscrowVault |
| CrymadX cmx-connect flow | Token issuance and audience checks |
- Out of scope
- Third-party chains and their RPC providers, third-party issuer contracts, CrymadX infrastructure beyond cmx-connect, social engineering, denial of service, findings from automated scanners without a demonstrated impact.
- Rules
- Test only accounts you own. Do not access other users' data. Do not move funds you do not own. Stop and report as soon as you can demonstrate the issue.
- Safe harbour
- Good-faith research within these rules will not be met with legal action.
Bounty tiers
Paid in CMX-U to a verified wallet after the fix ships. Amounts are ceilings; the committee decides within the tier.
| Severity | Reward | Examples |
|---|---|---|
| Critical | Up to 50,000 CMX-U | Unauthorised mint, reserve drain, passport anchor forgery, identity registry bypass |
| High | Up to 15,000 CMX-U | Data room access control bypass, eligibility statement forgery, account takeover |
| Medium | Up to 4,000 CMX-U | Stored XSS, CSRF on state-changing actions, gated cell leakage |
| Low | Up to 800 CMX-U | Information disclosure without impact, rate-limit gaps |
security.txt
Contact: mailto:security@cmxofficial.com
Expires: 2027-09-16T00:00:00.000Z
Encryption: https://marketplace.cmxofficial.com/.well-known/pgp-key.txt
Acknowledgments: https://marketplace.cmxofficial.com/security
Policy: https://marketplace.cmxofficial.com/security
Canonical: https://marketplace.cmxofficial.com/.well-known/security.txtPGP
Fingerprint 7C1E 4A9B 2D5F 8E03 C6A1 B4D7 E9F2 C5A8 B1D4 E7F0. The key is served at /.well-known/pgp-key.txt once the domain is live.