Security & Audits
Audit first, launch second — always. No $VANTA contract goes live before an independent
third-party audit, and every report is published here in full, including findings we didn't like.
Audit pipeline
| Stage | Scope | Status |
|---|---|---|
| Internal security review | Token, vesting, staking, marketplace escrow | Complete |
| Economic simulation | 10,000 simulated seasons — emissions, sinks, attack scenarios | Complete |
| Third-party smart-contract audit | All on-chain contracts + payout pipeline | Engagement in progress |
| Audit report publication | Full findings + remediations, published on this page | Before TGE |
| Public bug bounty | Contracts, payout pipeline, custody integration | Opens at TGE |
The auditing firm is announced at engagement, and the report is published here before the token generation event. If remediation is required, the TGE moves — the audit never does.
What gets audited
- Token contract — fixed 1B supply, no mint function, no owner privileges over balances.
- Vesting contracts — team, advisor, and private-round schedules enforced on-chain; no early-release path.
- Staking & fee distribution — lock tiers, weight math, and continuous fee share.
- Marketplace escrow — atomic item/token settlement, fee split, burn execution.
- Emission gateway — the server-to-chain bridge that converts verified match results into payouts, including its rate limits and caps.
Game security posture
- Server-authoritative simulation — clients are rendered views, never trusted inputs to the economy.
- Kernel-mode anti-cheat with ML behavioural detection and hardware bans.
- Stake forfeiture: confirmed cheaters in staked queues lose their entry stake and banked seasonal rewards.
- Multi-signature treasury with independent signers; every treasury movement is on-chain.
- Custodial wallets held with a regulated provider; self-custody export always available.
Responsible disclosure
Found a vulnerability — in the game, the site, or a contract? Report it to security@projectvanta.io. Good-faith researchers acting within scope will never face legal action from Vanta Studios, and qualifying reports are eligible for bounty rewards once the program opens.