PhantomPool is experimental software that has not been audited. It is intended for Stellar testnet only. Do not deploy it with real funds.

Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting. Do not open a public issue or pull request.

Include:

• the affected component (contract, circuit, backend, SDK, frontend) and commit hash
• a description of the issue and its impact
• steps or a test case that reproduces it

You can expect an acknowledgement within 3 working days and an assessment within 10. Once a fix is available we will credit you in the advisory, unless you prefer to stay anonymous.

Of particular interest:

• proofs that verify for statements they shouldn't (soundness), or proof malleability
• double spends, note forgery, or bypassing nullifier checks
• ways to redirect a withdrawal or settlement to an unintended recipient
• authorisation bypasses on admin-, operator- or settlement-only contract functions
• leaks of private order or balance data through the contracts, backend or events

Known limitations already listed in the README and roadmap are out of scope as vulnerability reports, but improvements to them are welcome as regular contributions.