Verdict Standard
Methodology
One rule governs everything we publish: no proof, no finding. A claim is only a finding when the exploit executes on a real EVM and moves value.
What our verdicts mean
- EXPLOITABLE
- The exploit executed and moved value. Not a pattern match, not a probability - a result.
- PROVEN
- The exploit is confirmed by execution and cross-checked before we publish it. Only PROVEN classes reach the Classes wall.
- PASS
- The exploit no longer works. A fix is proven, not promised - if it does not PASS, it is not fixed.
What a signed receipt guarantees
A receipt records the deterministic execution result - the exploit, the target, the state change - signed with our key. It lets anyone confirm the result without trusting us and without re-running. A receipt guarantees the execution happened and produced the stated effect. It does not disclose how the exploit was found - the model, the prover internals, and the detection method are trade secrets and never appear in a receipt or on this site.
The honesty rule
"No proven flags" is never "safe." A clean result means our engine did not prove an exploit - not that the contract is secure. Absence of a proof is not proof of absence. We publish what we can prove and label everything else as heuristic.
Concretely: our free honeypot check proves sellability by execution, not inference. Any surrounding risk signals are labelled heuristic. We do not publish an automated "safety score" or internal detection-effectiveness figures. When we cannot prove something, it reads UNVERIFIED - never a pass.
Disclosure policy
For findings against production systems we follow coordinated disclosure - the affected party first, a fixed window (90 days, or on-fix), and we never publish a working exploit against funds still at risk before mitigation. Reproductions of already-public incidents are for research and carry no at-risk-funds exposure.
Byline: OmniGuard Labs Research. We publish anonymously by design - the substitute for a named author is the artifact: every claim resolves to a signed, replayable receipt.