Security

Audit status

Reporting a vulnerability

Please do not report vulnerabilities in public issues.

1. Open the Security tab of the repository and click Report a vulnerability to use GitHub Security Advisories.
2. Or email the details to dicethedev@gmail.com.

Include as much as you can:

• a clear description of the issue;
• steps to reproduce, ideally with proof-of-concept code;
• affected versions or components;
• potential impact and severity, and whether you believe it is being actively exploited.

Don't disclose publicly until the issue is confirmed and fixed, and don't access, modify, or destroy data that isn't yours. The maintainers will acknowledge and investigate reports, may contact you for details, and will coordinate disclosure once a fix is available.

There is no formal bug bounty. With your consent, your contribution may be credited in the changelog or release notes.

The canonical policy is .github/SECURITY.md.

Design properties

• #![forbid(unsafe_code)] in every published crate.
• Domain separation between leaves (0x00) and internal nodes (0x01), or BLAKE3 context strings, to prevent second-preimage attacks. See Mental model.
• Empty leaves rejected so inserted data can't be confused with padding.
• Verifiers never panic on malformed proofs; they return false.
• Deserialization rebuilds internal nodes from leaves and rejects data from another hash algorithm, so a decoded tree is always internally consistent.

What integrators must get right

• Trust the root, not the prover. A proof shows consistency with a root; it says nothing about whether that root is the right one.
• MerkleProof::leaf_count is not committed by the binary root. Obtain it independently if it matters.
• Check the key on sparse proofs with verify_membership. The deprecated SparseMerkleTree::verify accepts a valid proof for any key holding the value.
• Canonical leaf encoding. Prover and verifier must hash exactly the same bytes.
• Custom hash adapters must keep leaf and node domains separate. Since v0.5.0, the default hash_nodes applies the 0x01 prefix for you. See Hash functions.