The OmniGuard Verdict Standard
One rule governs everything we publish: no proof, no finding. A claim is only a finding when the exploit executes on a real EVM and moves value. This page is the citable standard behind every verdict — what the words mean, what a receipt guarantees, and what we will and won't claim.
The three verdicts
- EXPLOITABLE
- The exploit ran against the vulnerable contract on a real EVM and produced the loss/effect. Not "a pattern was matched" — value moved.
- PROVEN
- A vulnerability class is PROVEN when the exploit is EXPLOITABLE on the vulnerable case and a patched control PASSes — i.e.
proven_rate = 1.0andfalse_prove = 0across the pair. This is the bar for the Proof Wall. - PASS
- The clean/patched control resisted the same exploit. A PASS is what makes a false-positive claim falsifiable — if a "fix" doesn't PASS, it isn't a fix.
What a signed receipt guarantees
A receipt records the deterministic execution result — the exploit, the target, the state change — signed with our key. It lets anyone confirm the result without trusting us and without re-running. A receipt guarantees the execution happened and produced the stated effect. It does not disclose how the exploit was found — the model, the prover internals, and the detection method are trade secrets and never appear in a receipt or on this site.
The honesty rule (what we will not claim)
Concretely: our free honeypot check proves sellability by forking the chain and attempting the sell (execution truth). Any surrounding risk signals are labelled heuristic. We do not publish an automated "detection effectiveness" or safety score until it clears a pre-registered real-world benchmark (false_prove = 0 and a recall floor). The published false-positive number — 0 / 351 proven false-positives on professionally-audited contracts — is a measurement, not a marketing claim.
Disclosure policy
For findings against live systems we follow coordinated disclosure — the affected party first, a fixed window (90 days, or on-fix), and we never publish a working exploit against live funds before mitigation. Reproductions of already-public incidents are for research and carry no live-funds risk.