Security
Researcher Acknowledgments
The independent security researchers who have responsibly disclosed findings to Kerne, credited by the handle of their choosing and with their consent. Finding class, report date, and current status for each, with no exploit detail.
Researchers who disclosed
13
Publicly credited
12
Awaiting consent to list
1
Nearly every outside party that has looked closely at Kerne so far has been a security researcher. That is just where we are this early, and we would rather be upfront about it. Each report below got a real technical response from someone who read the proof of concept and worked the fix.
For reports sent to us directly we do not run a paid bounty and we do not guarantee payment. What we do is read every good-faith report and respond seriously, and give safe harbor for that work. When a researcher wants public credit, we list them here by the handle they choose. We prioritize critical findings. A separate listing on Remedy, prepared and not yet live, will carry a fixed reward ladder settled in the KERNE token, scoped to findings submitted there from its listing date forward; the ladder and what it is actually worth are set out in sections 3.5 and 3.6 of the bug bounty program.
We list a researcher only after they tell us they want public credit, so this list is shorter than the full set who have helped. And we describe a finding by its class and current status only, never the exploit path, and only once it is no longer exploitable on the live contracts, whether because the fix has shipped or because the surface was never reachable. Enough detail to verify a bug is also enough to use it, so we hold that detail until then. This is the same coordinated-disclosure posture described on the findings-response page.
What came of them
13 researchers, from June 16, 2026 to August 21, 2026. The surfaces they looked at: Insurance Fund, Migration residue, Mint routing, Peg Stability Module, Staking (escrowed KERNE), Treasury buyback, Vault circuit breaker, Vault share accounting, Yield oracle, Yield oracle and APY.
3
Fixed and live
5
Fixed in source, ships with a redeploy
3
Accepted, no live impact
2
Independent rediscovery of a known defect
None of these were paid. Kerne has never paid a bug bounty reward to anyone, and the balance it holds against the rewards it has already committed in writing is published, read off chain, on the bug bounty program page. Being listed here is credit for a disclosure and nothing else: it does not make anyone staff, a contractor, or a creditor.
Credited researchers
ParthaSarathi
Peg Stability Module · reported August 1, 2026
Configuration state is an axis that a source-to-deployed comparison cannot see: a contract can match its source exactly and still have a check switched off by a setter, and the auditor-facing record carried no pointer to where the live values of those flags are published.
Status: Accepted. The configuration-state axis is now named in the published deployed-versus-source record and in the audit scope, both crediting him by name, and each flag of this kind is published as a live on-chain read rather than inferred from source. Conceded one of his own two reports in writing rather than stretch the evidence, and said he would rather have the correction than miss it, which is the disclosure standard this wall exists to reward.
Abhinav Raj
Staking (escrowed KERNE) · reported July 29, 2026
Partial conversion on the escrowed-KERNE path can strand part of a vested balance.
Status: Accepted, and he was first to report it. Not reachable on the live contracts for the same reason the escrowed-KERNE entries below are latent, and recorded against that redeployment. Sent five reports and, inside two that duplicated earlier work, identified two escalations nobody else had reached.
Ankit Pandey
Vault circuit breaker · reported July 29, 2026
Coverage review of the automatic collateral-ratio circuit breaker, on whether every state-changing path that can move the ratio re-arms the same guard.
Status: Independent rediscovery of a defect already fixed in source under KRN-26-VAULT-CR-BUCKET-BYPASS on June 7, 2026, which predates the report. Credited because the work was genuine and arrived at the same conclusion from scratch, not because it was new to us. Wrote all five reports with runnable proofs of concept and self-classified severity conservatively. Told plainly, and accepted, that a rediscovery does not earn an amount under the published conditions.
Mohd Huzaifa
Vault share accounting · reported July 29, 2026
Share accounting on the vault's asset-exit path, where the recorded net asset value can understate the assets actually backing existing shares.
Status: Accepted as a pre-funding defect. Not reachable on the live vault: public deposits are closed (maxDeposit returns zero and the whitelist is enabled), so nothing can be minted against an understated valuation. The fix ships with the audited redeploy. Scored the finding below the severity he could have claimed, and waived any reward claim on the headline figure once he had seen the vault's real size. Has offered to re-test the fix after the redeploy.
reodkt
Migration residue · reported July 21, 2026
Low-severity bundle on drift between the documented state and the deployed state of retired migration components.
Status: Reviewed and accepted. No fund-loss path: each item was already known and dispositioned, and the components involved are superseded by the planned redeploys. Self-classified the bundle as low severity and set out plainly what had deliberately not been escalated, which is the disclosure standard this wall exists to reward.
Dmitriy Filatov
Treasury buyback · reported July 14, 2026
Buyback slippage floor derived from a same-transaction pool quote, without an independent price reference.
Status: Accepted. No live impact: the buyback flywheel is disarmed (no keeper, no inventory, no live venue). Recorded as a mandatory pre-arming gate and included in the external audit scope. Supplied a working proof-of-concept harness, which is being folded into the buyback regression suite.
@Olamdeen
Yield oracle · reported July 4, 2026
Denial-of-service in the yield oracle's multi-party consensus path.
Status: Fixed in source. No live impact, because the live oracle does not run the multi-party consensus path; the fix ships with the next oracle deployment.
Kor_HaeTae
Insurance Fund · reported July 4, 2026
Insurance-fund accounting gap on untracked injections.
Status: Fixed in source, pending redeploy.
Ekankaar
Mint routing · reported June 25, 2026
Stale routing-quote handling in the mint flow.
Status: Fixed and live.
Jay
Staking (escrowed KERNE) · reported June 24, 2026
Vesting-accounting review of the escrowed-KERNE path.
Status: Fixed in source; ships with the esKERNE redeploy.
SpokoDev
Staking (escrowed KERNE) · reported June 23, 2026
Forfeiture-on-exit could be bypassed on the escrowed-KERNE vesting path.
Status: Fixed in source. Latent on-chain (the escrow is unfunded); ships with the esKERNE redeploy. Has offered to re-test the fix after deployment, and on July 22, 2026 publicly confirmed the review in their own words.
Gaurang Maheta
Yield oracle and APY · reported June 16, 2026
Yield-oracle-to-vault linkage and the honesty of the displayed APY.
Status: Addressed. The APY methodology and its public presentation were hardened, including an independent-yield comparator.
1 more researcher has disclosed findings and been credited privately, and we have asked whether they would like public credit. We add each one here only if they say yes. Total who have responsibly disclosed to date: 13.
In their own words
Where a researcher has confirmed their review publicly and put it in their own words, we reproduce the statement exactly as they granted it, together with the scope caveat they asked us to keep alongside it. Everything on this page is self-reported by Kerne except these lines, which is exactly why they are here.
“SpokoDev reviewed Kerne's escrowed-KERNE (esKERNE) exit path and reported a forfeiture-on-exit bypass, which the team fixed in commit 8193babd.”
In the researcher's own words, this "was a focused review of specific paths, not a full audit, and a single finding is never a clean bill of health." An external researcher reviewed this area and we fixed what they reported. It is not an audit and not a security guarantee.
Report something
Found an issue? The scope, severity guidance, and safe-harbor terms are on the Bug Bounty Program page. Report to kerne.systems@protonmail.com. How findings from the in-progress external audit are triaged and disclosed is pre-committed on the findings-response protocol page, and the internal-audit remediation status is on the findings tracker.