Security at QoreChain
QoreChain was built for adversaries that do not exist yet. The same discipline applies to the ones that do: post-quantum cryptography at every layer, a standing bug bounty, responsible disclosure, and independent review.
Quantum-safe by construction
Full-stack post-quantum cryptography
ML-DSA-87 (Dilithium-5, FIPS 204) for signatures, ML-KEM-1024 (Kyber, FIPS 203) for key encapsulation, SHAKE-256 for hashing. Applied to consensus, transactions, bridges, and state verification, not bolted on.
NIST Category 5
QoreChain targets the highest NIST security category, equivalent to AES-256, for 128-bit post-quantum security across the protocol stack. The standards it implements were finalized by NIST in August 2024.
Wallet security by default
QoreX, the official wallet, is non-custodial: keys are generated and stored only on your device, every QOR transfer is signed with mandatory ML-DSA-87, and the apps collect no analytics and no personal data.
A 67,500,000 QOR bug bounty
Opened at mainnet launch on 7 June 2026 and active throughout the network's lifetime. Rewards scale with severity; PQC implementation issues carry the highest priority.
In scope
- Consensus vulnerabilities
- PQC cryptographic implementation issues, including side channels
- Bridge security: circuit breaker bypass, attestation forgery
- AI module manipulation: anomaly detection bypass
- Privilege escalation
- Denial of service
Responsible disclosure
- 1Report privatelyWrite to security@qore.network with a description, reproduction steps, and impact. Please do not open a public GitHub issue for security reports.
- 2Acknowledgement in 48 hoursWe confirm receipt within 48 hours and send a detailed response within 7 days.
- 3Fix and discloseCritical vulnerabilities are targeted for a fix within 30 days. Public disclosure follows once the fix is deployed to mainnet, and reporters are credited unless they prefer anonymity.
Independent review
Third-party audit
An independent third-party security audit of the protocol is ongoing, with results to be published in the project data room when complete. The core protocol builds on the Cosmos SDK, and QoreChain's public interfaces, types, and protocol definitions are open source on GitHub.