Professionally Audited by Verichains

The OPNet Smart Contract Runtime has undergone a comprehensive security audit by Verichains, a leading blockchain security firm with extensive experience in:

• Smart contract security audits
• Blockchain protocol assessments
• Cryptographic implementation reviews
• WebAssembly security analysis

The security audit covered all core components of the btc-runtime:

• OP_NET Base Contract - Abstract contract class, lifecycle hooks, method dispatching
• OP20 Token Standard - Fungible token implementation, transfers, approvals, minting/burning
• OP20S Signatures - Gasless approvals, EIP-712 typed signatures, nonce management
• OP721 NFT Standard - Non-fungible tokens, ownership, enumeration, metadata
• ReentrancyGuard - Reentrancy protection mechanisms (STANDARD and CALLBACK modes)

• Pointer Architecture - u16 primary pointers, u256 sub-pointers, SHA256 key hashing
• Persistent Storage - StoredU256, StoredString, StoredAddress, StoredBoolean
• Array Storage - StoredU256Array through StoredU8Array, bounds checking
• Map Storage - StoredMapU256, AddressMemoryMap, MapOfMap nested structures

• Signature Verification - Schnorr signatures, ML-DSA quantum-resistant signatures
• Hash Functions - SHA256, double SHA256 (hash256)
• EIP-712 Domain Separator - Typed data signing, replay protection
• Address Derivation - P2TR, P2WSH, P2WPKH address generation

• SafeMath Operations - Overflow/underflow protection for u256, u128, u64
• Access Control - onlyDeployer patterns, role-based authorization
• Input Validation - Calldata parsing, bounds checking, type verification
• Event System - 352-byte limit enforcement, proper encoding

• Transaction Parsing - Input/output decoding, script parsing
• Address Validation - Bitcoin address format verification
• Script Building - Opcodes, CSV timelocks, witness structures
• Network Configuration - Mainnet/testnet handling

When developing contracts with btc-runtime, follow these guidelines:

import { SafeMath } from '@btc-vision/btc-runtime/runtime';

// CORRECT: Use SafeMath
const total = SafeMath.add(balance, amount);
const remaining = SafeMath.sub(balance, amount);

// WRONG: Direct arithmetic can overflow silently
// const total = balance + amount;  // DON'T DO THIS

class Test extends OP_NET {
    public transfer(calldata: Calldata): BytesWriter {
        const to = calldata.readAddress();
        const amount = calldata.readU256();

        // Validate recipient is not zero address
        if (to.equals(Address.zero())) {
            throw new Revert('Cannot transfer to zero address');
        }

        // Validate amount is positive
        if (amount.isZero()) {
            throw new Revert('Amount must be greater than zero');
        }

        // ... proceed with transfer
    }
}

import { ReentrancyGuard, ReentrancyGuardMode } from '@btc-vision/btc-runtime/runtime';

@final
export class MyContract extends ReentrancyGuard {
    constructor() {
        // Use CALLBACK mode for contracts with safe transfer callbacks
        super(ReentrancyGuardMode.CALLBACK);
    }
}

// Check deployer authorization
this.onlyDeployer(Blockchain.tx.sender);

// Custom role checks
class Test {
    private onlyAdmin(): void {
        if (!this.isAdmin(Blockchain.tx.sender)) {
            throw new Revert('Caller is not admin');
        }
    }
}

const result = Blockchain.call(targetContract, calldata, true);

if (!result.success) {
    throw new Revert('External call failed');
}

// Parse and validate response
const response = result.data;

// WRONG: Floating-point is non-deterministic
// const price = 1.5;  // DON'T USE FLOATS

// CORRECT: Use fixed-point with integers
const PRECISION = u256.fromU64(1_000_000); // 6 decimals
const price = SafeMath.mul(amount, PRECISION);

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

1. DO NOT open a public GitHub issue for security vulnerabilities
2. Report via GitHub Security Advisories
3. Include detailed steps to reproduce the vulnerability
4. Allow reasonable time for a fix before public disclosure

• Description of the vulnerability
• Affected component(s) and version(s)
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if any)
• Proof of concept (if applicable)

The full audit report from Verichains will be published here upon completion of the disclosure process.

📄 [Audit Report - Coming Soon]

• Security Issues: GitHub Security Advisories
• General Questions: GitHub Issues
• Website: OPNet
• Auditor: Verichains

_{Security is a continuous process. This document will be updated as new audits are completed.}