Security Disclaimer

A security assessment is a time-bound review by people and tools. It can find vulnerabilities and make a successful attack less likely, but it cannot prove that a system has none. Issues may remain that were outside the scope, beyond the techniques applied, or not discoverable in the time available.

No assessment, report, verification result, score or monitoring rule is a guarantee or warranty of security, correctness or fitness for any purpose.

Every assessment describes a specific scope: named files at named commits, reviewed during a stated window. Its conclusions apply only to that code as it existed then.

• Code changed after the reviewed or remediation commit is not covered.
• Deployed bytecode can differ from reviewed source if the build or deployment differs.
• External contracts, oracles, bridges and off-chain components are covered only when explicitly in scope.
• Economic and market conditions change, and analysis based on them may stop holding.

Quantix Protocol Research is the body of research material behind the Security Explorer, the assessments, the recorded investigations and the case studies:

• Protocol profiles describe protocol designs modelled by Quantix researchers on common architectures. Their names, code excerpts, addresses, transaction hashes and team roles are written or generated for research; any resemblance to a real project is coincidental.
• Research assessments and the Quantix Technical Security Assessment documents generated from them describe these designs, not client engagements.
• Identifiers such as addresses and hashes are generated deterministically for Quantix Protocol Research and are not linked to block explorers.
• Case studies and roles describe how an investigation or a research team is structured, not real events or people.

The vulnerability classes, standards, EIPs, tools and mitigations discussed in that material are real and cited to their sources.

The Quantix Risk Index, grades, risk tiers and maturity ratings are outputs of published models. For Quantix Protocol Research they are applied to the research profiles; for deployed public protocols they are computed only from observed public signals, with their coverage and confidence shown, and are withheld as Insufficient Data when too few signals exist. Their weights and inputs are documented on the site. They are not credit or investment ratings, not audit results, and not a substitute for your own analysis.

Recorded investigations re-run archived incidents from Quantix Protocol Research. Connected views show events and transactions read from public blockchains by the configured providers; they cover only the contracts and addresses watched or requested, may lag the chain, and can change when a chain reorganisation removes a block. Verify anything you act on independently.

The Security Standards and Assurance Framework pages describe how assessments map to, and how Quantix practices align with, published standards and frameworks. Quantix does not hold, and does not claim, any certification, attestation or accreditation against them.

ISO/IEC 27001 certificates are issued only by accredited certification bodies, and SOC 2 reports only by licensed CPA firms. A technical assessment can provide evidence for those processes; it does not replace them.

An assessment, a score or a listing on this website is not an endorsement of a project, its team or its token, and is not a recommendation to use, buy, sell or hold any digital asset.

Formal verification proves that an implementation satisfies stated properties under a stated model and set of assumptions. It says nothing about properties that were not specified, and its conclusions depend on the specification, the model of the environment and the tools used. A proof is strong evidence about a precise claim, not a guarantee that a system is secure.

Penetration testing is performed only under written authorisation that defines targets, techniques and timing. Results describe the systems as tested on the dates of testing.

Monitoring and incident response are provided only under a written agreement. Nothing on this website is a commitment to availability or to respond within a particular time.

Research articles explain vulnerability classes and techniques, often with simplified code that is not intended for production. Where an article discusses a real public incident, it relies on the cited public sources and credits the original discoverers. Articles reflect the authors’ understanding at the date of publication and may be revised.

Where content relies on third-party standards, tools or documentation, it follows those sources as published. We are not responsible for their accuracy or for changes made after publication.

To report a vulnerability, follow the reporting guide under the Responsible Disclosure Policy. For questions about this disclaimer, use the contact form.