The following versions of the ViWo Protocol Stack are currently supported with security updates:

We take the security of the ViWo Protocol Stack seriously. If you believe you have found a security vulnerability, please report it to us responsibly.

Email: security@viwoapp.com

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Any suggested fixes (optional)

• We request 90 days to address the issue before public disclosure
• We will credit researchers in our security advisories (unless anonymity is requested)
• We do not pursue legal action against good-faith security researchers

All security findings from our comprehensive internal review have been addressed:

1. C-01: ZK Proof Verification - Private voting blocked until proper ZK infrastructure implemented (ZK_VOTING_ENABLED = false)
2. C-02: Decryption Share Storage - Shares now properly stored on-chain
3. C-03: Vote Aggregation - Now blocked until on-chain computation implemented
4. C-04: veVCoin CPI Integration - Staking now mints/burns real veVCoin tokens
5. C-NEW-01: Voting Power Verification - Now reads from on-chain state
6. C-NEW-02: Legacy Slash Disabled - Must use governance-approved flow

1. H-01: Governance Slashing - 48-hour timelock with proposal approval
2. H-02: Two-Step Authority Transfer - 24-hour timelock across all 11 protocols
3. H-03: Session Key Verification - Cryptographic signature verification added
4. H-04: Epoch Claim Bitmap - Extended to support epochs 0-1023 (85+ years)
5. H-05: Oracle Multi-Consensus - 3-of-N agreement required for 5A scores
6. H-NEW-01: Authority Transfer Timelock - Actual 24-hour enforcement
7. H-NEW-02: Merkle Proof Size Limit - Maximum 32 levels (DoS prevention)
8. H-NEW-03: Delegation Amount Validation - Prevents excess voting power
9. H-NEW-04: High Epoch Bitmap - Replaced array with bitmap (no overflow)
10. H-NEW-05: Proposal Threshold - On-chain verification of proposer holdings

Status: Recommended before mainnet launch

We recommend engaging a professional security auditor (e.g., Neodyme, OtterSec, Kudelski) for an independent review before mainnet deployment.

// governance-protocol/src/constants.rs
pub const ZK_VOTING_ENABLED: bool = false;  // Must remain false until ZK ready

All protocol authorities should be:

• Multisig wallets (e.g., Squads)
• Hardware wallet backed
• With appropriate threshold (3-of-5 or higher)

1. Authority transfers require 24-hour waiting period after proposal
2. Slashing requires governance vote + 48-hour timelock
3. Circuit breaker requires 6-hour cooldown before reset
4. Oracle updates require 3-of-N consensus

Status: Coming Soon

We are preparing a bug bounty program with the following anticipated structure:

Details will be announced on our official channels.

// Always specify the VCoin mint for accurate balance queries
const client = new ViWoClient({
  connection: { endpoint: "https://api.mainnet.solana.com" },
  wallet: walletAdapter,
  programIds: {
    vcoinMint: new PublicKey("YOUR_VCOIN_MINT_ADDRESS"),
  },
});

// Handle errors appropriately - SDK now logs warnings
try {
  const balance = await client.getVCoinBalance();
} catch (error) {
  console.error("Balance query failed:", error);
}

// Always verify PDA derivation matches expected seeds
let (expected_pda, bump) = Pubkey::find_program_address(
    &[SEED, user.key().as_ref()],
    program_id
);
require!(account.key() == expected_pda, CustomError::InvalidPDA);

// Validate account ownership
require!(
    account.owner == &expected_program_id,
    CustomError::InvalidOwner
);

• Security Issues: security@viwoapp.com
• General Questions: Discord
• GitHub: github.com/MohaMehrzad/VCoin-V2

Last Updated: December 2025 Version: 2.8.4