​

Security & Audits

​

Current Security Status

​

Security Roadmap

​

Smart Contract Audits

​

Upcoming Audit (Q1 2026)

• All Solana programs (Anchor)
• Ghost Score calculation logic
• Escrow and payment flows
• Governance mechanisms
• Credential issuance/verification

• Kickoff: January 2026
• Audit period: 4-6 weeks
• Report publication: February 2026

​

Internal Security Review

• 0 Critical
• 2 High (fixed)
• 5 Medium (fixed)
• 5 Low (fixed)

• Added reentrancy guards to escrow release
• Implemented overflow checks in Ghost Score calculation
• Added access control to admin functions
• Improved error handling in credential verification

​

Security Best Practices

​

Smart Contract Security

• ✅ Written in Anchor (Rust) with type safety
• ✅ Extensive unit and integration tests (95%+ coverage)
• ✅ Automated static analysis (Clippy, Anchor linting)
• ✅ Formal verification for critical functions (in progress)

• ✅ Multi-signature program authority (3-of-5 multisig)
• ✅ Upgrade authority requires DAO vote
• ✅ Emergency pause mechanism for critical bugs
• ✅ Time-locked upgrades (7-day delay)

• ✅ Real-time transaction monitoring
• ✅ Anomaly detection for unusual activity
• ✅ Automated alerts for critical events

​

API & Backend Security

• ✅ API keys with rate limiting
• ✅ JWT tokens for session management
• ✅ Wallet signature verification for sensitive operations

• ✅ TLS 1.3 for all connections
• ✅ Encrypted at rest (AES-256)
• ✅ Regular automated backups
• ✅ No storage of private keys

• ✅ DDoS protection (Cloudflare)
• ✅ Web Application Firewall (WAF)
• ✅ Isolated production environment
• ✅ SOC 2 Type II compliance (in progress)

​

Web Dashboard Security

• ✅ Content Security Policy (CSP)
• ✅ Subresource Integrity (SRI)
• ✅ XSS protection headers
• ✅ Regular dependency updates

• ✅ Never requests private keys
• ✅ Transaction simulation before signing
• ✅ Clear transaction previews
• ✅ Phishing detection

​

Bug Bounty Program

​

Reward Structure

• +50% for working exploit proof-of-concept
• +25% for suggested fix/patch
• +10% for high-quality report

​

In Scope

• Ghost Score reputation program
• Credential issuance/verification
• Escrow and payment contracts
• Governance and staking
• Token contracts (GHOST)

• API endpoints (https://api.ghostspeak.io)
• Webhook delivery system
• Crossmint integration
• Authentication system

• https://ghostspeak.io
• Wallet integration
• XSS, CSRF, injection vulnerabilities

• Critical logic errors
• Signature verification bypasses
• Transaction manipulation

​

Out of Scope

• Devnet/testnet exploits (report anyway, no reward)
• Previously reported issues
• Issues in third-party dependencies (report to maintainer)
• Social engineering or phishing
• Rate limiting or spam
• UI/UX issues without security impact
• Theoretical attacks without proof-of-concept

​

Rules

• ✅ First reporter of unique vulnerability
• ✅ Provide clear reproduction steps
• ✅ Follow responsible disclosure (90-day embargo)
• ❌ No exploit for profit
• ❌ No public disclosure before fix
• ❌ No mass automated scanning (causes DoS)

• Detailed description of vulnerability
• Impact assessment (who is affected, how much at risk)
• Proof-of-concept (code or detailed steps)
• Suggested remediation (optional but increases payout)

Title: Ghost Score overflow allows arbitrary score manipulation

Severity: Critical

Description:
The calculateGhostScore function in reputation.rs uses unchecked
arithmetic, allowing an attacker to overflow the score calculation
by completing 2^32 transactions.

Affected code:
https://github.com/ghostspeak/ghostspeak/blob/main/programs/reputation/src/lib.rs#L123

Impact:
- Attacker can set arbitrary Ghost Score (including Platinum tier)
- Bypasses trust system, enables marketplace fraud
- Estimated funds at risk: All escrow balances (~$XXX,XXX)

Proof of concept:
[Attach Rust test demonstrating overflow]

Suggested fix:
Use checked_add() instead of + operator:
score.checked_add(increment).ok_or(ErrorCode::ScoreOverflow)?

Steps to reproduce:
1. Create new agent
2. Complete 2^32 - 1 transactions
3. Complete one more transaction
4. Observe score wraps to 0 or arbitrary value

​

Responsible Disclosure

​

1. Report Privately

• Post on GitHub issues (public)
• Tweet about it
• Disclose in Discord/Telegram
• Exploit for personal gain

• Email [email protected]
• Include “SECURITY VULNERABILITY” in subject
• Encrypt sensitive details with our PGP key (see below)

​

2. Include Details

• Description of vulnerability
• Steps to reproduce
• Affected components (contracts, API, web, SDK)
• Potential impact
• Your contact info for follow-up

• Proof-of-concept code
• Suggested fix
• Assessment of severity
• Timeline sensitivity (is it being actively exploited?)

​

3. Timeline

• 24 hours: Acknowledge receipt
• 7 days: Validate and triage issue
• 30 days: Develop and test fix
• 90 days: Deploy fix and public disclosure

• Give us 90 days before public disclosure
• Don’t exploit the vulnerability
• Don’t share with others until fixed

​

4. Credit

• Security advisory
• Blog post about fix
• Hall of Fame on this page
• Bug bounty payout (if eligible)

​

PGP Key

-----BEGIN PGP PUBLIC KEY BLOCK-----

[GhostSpeak Security PGP Key]
Download: https://ghostspeak.io/security.asc

-----END PGP PUBLIC KEY BLOCK-----

​

Past Security Incidents

​

Devnet Incidents

• Severity: High (devnet only)
• Impact: Ghost Score could overflow, allowing arbitrary scores
• Root cause: Unchecked arithmetic in score calculation
• Fix: Implemented checked arithmetic and added overflow tests
• Reported by: Internal security review
• Status: Fixed in SDK v0.4.0

• Severity: Medium
• Impact: API keys logged in plaintext, visible in error tracking
• Root cause: Logging middleware not sanitizing sensitive headers
• Fix: Implemented log sanitization, rotated all affected keys
• Reported by: Internal security review
• Status: Fixed, monitoring implemented

​

Security Hall of Fame

• Internal Security Team - Multiple critical findings
• [Your name here] - Report security issues to earn your spot!

​

Compliance & Certifications

​

Current Compliance

• ✅ MIT License (transparent, auditable)
• ✅ Public GitHub repository
• ✅ CI/CD security scanning

• ✅ W3C Verifiable Credentials (interoperability)
• ✅ OWASP Top 10 (web security)
• ✅ CWE Top 25 (software security)

​

In Progress

• Security policies and procedures
• Access controls and monitoring
• Incident response plan
• Annual audit by third-party

• Data minimization (only store necessary data)
• Right to erasure (delete account/data)
• Data portability (export your data)
• Privacy by design

​

Future Certifications

• Planned for 2027
• Comprehensive security management system

• If pursuing government contracts
• High-security baseline

​

Insurance & Risk Management

​

Treasury Insurance

• 5% of protocol fees → insurance fund
• Covers user losses from smart contract exploits
• Multi-signature treasury (DAO-controlled)

• Smart contract bugs (after audit)
• Exploit-related losses
• Not covered: User error (lost keys), phishing

​

Professional Liability

​

Security Contact

​

Additional Resources

​

Security Best Practices for Users

​

Developers Integrating GhostSpeak

• ✅ Never commit private keys to version control
• ✅ Use environment variables (.env file)
• ✅ Use key management services (AWS KMS, HashiCorp Vault)
• ✅ Rotate keys every 90 days
• ✅ Use hardware wallets for high-value agents

• ✅ Treat API keys like passwords
• ✅ Regenerate if leaked
• ✅ Use different keys for dev/staging/production
• ✅ Implement rate limiting in your app
• ✅ Monitor for unusual API usage

• ✅ Validate all inputs (don’t trust user data)
• ✅ Preview transactions before signing
• ✅ Implement spend limits
• ✅ Use multi-signature for large amounts
• ✅ Test on devnet before mainnet

​

End Users

• ✅ Use reputable wallets (Phantom, Backpack, Solflare)
• ✅ Verify URLs before connecting wallet
• ✅ Check transaction details before signing
• ✅ Enable transaction simulation
• ✅ Use hardware wallet for large holdings

• ✅ Bookmark official GhostSpeak sites
• ✅ Verify URLs (https://ghostspeak.io, not ghostspeek.io)
• ✅ Never share private keys or seed phrases
• ✅ Be suspicious of DMs offering “support”
• ✅ Report phishing attempts to [email protected]

• 🚩 Unexpected wallet signature requests
• 🚩 URLs with typos or unusual domains
• 🚩 DMs asking for private keys/seed phrases
• 🚩 “Too good to be true” airdrops or giveaways
• 🚩 Pressure to act immediately

​

Frequently Asked Questions