TESTNET — Verdis Chain is currently in testnet phase. Not mainnet. Not investor-ready.

Security

Last updated: August 8, 2026

1 Overview

1.1. Security is a core priority for Verdis Chain. As a blockchain platform handling user assets through the Web Wallet, DEX, and faucet, we implement multiple layers of security across infrastructure, application, and protocol levels.

1.2. This page documents our security practices, architecture, and responsible disclosure policy. We are committed to transparency and continuous improvement of our security posture.

2 Infrastructure Security

Server Hardening

SSH key-only authentication (password login disabled), Fail2Ban intrusion prevention, automated security updates, and minimal attack surface through service isolation.

SSL/TLS Configuration

TLS 1.3 enforced with HSTS, strong cipher suites, OCSP stapling, and automatic certificate renewal via Let's Encrypt. All traffic served over HTTPS with HTTP-to-HTTPS redirects.

Security Headers

Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, and Permissions-Policy headers configured on all pages via nginx.

Network Security

Firewall rules restrict access to internal services (RPC, database, monitoring). Only HTTP/HTTPS (ports 80/443) and WebSocket endpoints are publicly accessible.

3 Wallet Security

3.1. The Verdis Chain Web Wallet is a non-custodial wallet. This means:

  • Your private keys are generated and stored entirely in your browser's local storage
  • We never transmit, store, or have access to your private keys or seed phrase
  • All transactions are signed client-side before being broadcast to the network
  • You are solely responsible for backing up your seed phrase securely

3.2. We use @noble/secp256k1 and @noble/hashes for cryptographic operations, which are audited, battle-tested cryptographic libraries.

3.3. The wallet supports importing existing accounts via seed phrase or private key. Imported keys are processed entirely in the browser and never sent to any server.

4 Blockchain Protocol Security

4.1. Verdis Chain uses Delegated Proof of Stake (DPoS) consensus with the following security properties:

  • Validator selection — 21 registered validators (6 active) elected by token holders
  • Slashing — Validators can be slashed for malicious behavior (double-signing, downtime)
  • Finality — Blocks are finalized through GRANDPA consensus
  • On-chain governance — Protocol upgrades require on-chain approval

4.2. The Substrate framework provides additional security through:

  • Sandboxed WebAssembly (WASM) execution environment
  • Weight-based fee system preventing resource exhaustion attacks
  • Storage rent preventing state bloat
  • Upgradable runtime without hard forks

5 Smart Contract Security

5.1. The Verdis Chain runtime includes the following pallets that have undergone internal security review:

  • AMM DEX — Constant product formula with overflow protection
  • DPoS — Validator election, staking, and slashing logic
  • Eco — Carbon credit tracking and green validator scoring
  • Tokenomics — Token supply, vesting, and allocation management
  • Contracts — ink! smart contracts via pallet_contracts

5.2. A comprehensive security audit was conducted in August 2026, covering all pallets. Key findings were remediated:

  • Fixed division-by-zero vulnerability in remove_liquidity
  • Fixed self-scoring vulnerability in update_green_score
  • Added authorization check to mint_carbon_credit
  • Added overflow protection to LP token minting

6 DEX Security

6.1. The AMM DEX implements the following security measures:

  • Overflow protection — All arithmetic operations use checked math
  • Slippage protection — Users specify minimum output amounts
  • Deadline protection — Transactions expire after a block deadline
  • Reentrancy guard — Prevents reentrancy attacks on swap and liquidity functions
  • Front-running mitigation — Transaction ordering is determined by the block producer

7 Data Protection

7.1. We comply with GDPR requirements. See our Privacy Policy for details on data collection, processing, and user rights.

7.2. We do not collect or store:

  • Private keys or seed phrases
  • Personally identifiable information beyond what is necessary for service operation
  • Analytics data shared with third parties

7.3. Blockchain transactions are public by nature. All transactions on the Verdis Chain are visible on the Verdiscan explorer.

8 Responsible Disclosure

8.1. We take security vulnerabilities seriously. If you discover a security issue, we encourage responsible disclosure.

How to Report

Email: security@protremix.com
Please include a detailed description of the vulnerability, steps to reproduce, and potential impact.

8.2. We commit to:

  • Acknowledging receipt of your report within 48 hours
  • Providing an initial assessment within 5 business days
  • Notifying you when the vulnerability is fixed
  • Crediting responsible disclosure (unless you prefer to remain anonymous)

8.3. We ask that you:

  • Do not exploit the vulnerability or access others' data
  • Do not publicly disclose the vulnerability until it is fixed
  • Provide sufficient information to reproduce and verify the issue

9 Incident Response

9.1. In the event of a security incident, we will:

  • Assess the scope and impact immediately
  • Notify affected users within 72 hours of confirmation
  • Take corrective action to prevent recurrence
  • Conduct a post-mortem and publish findings where appropriate

9.2. For critical vulnerabilities affecting user funds, we may pause the DEX or faucet temporarily while remediation is deployed.

10 Contact

10.1. For security-related questions or concerns:

Audit Status: No independent security audit has been completed. An external audit firm is being engaged. All security measures are internal and have not been independently verified.