Skip to main content

Testnet Security Model

Read this before reporting a security issue found on testnet.

Last updated: August 2026 | Network stage: Public beta testnet

Testnet is not a security environment​

The Vexidus public beta testnet exists to exercise throughput, consensus, tooling and developer experience. It is not a demonstration of the mainnet security model, and its behaviour must not be read as one.

Concretely, and stated plainly because researchers keep discovering it independently:

Transaction signatures are not enforced on testnet​

The testnet node accepts state-changing transactions without verifying the sender's signature. Anyone who can reach the public testnet RPC can submit operations naming any sender — transfers, validator parameter changes, token operations — and the network will execute and finalize them.

This is a deliberate testnet configuration, not a defect. Signature enforcement is a launch requirement for mainnet and is switched on there.

What that means for you​

  • Testnet tokens have no value and no protection. Do not put anything on testnet you would mind losing, and do not treat a testnet balance as yours in any meaningful sense.
  • Never reuse a testnet key on mainnet. This was always good practice; here it is essential.
  • Do not infer mainnet posture from testnet behaviour in either direction. Something permitted on testnet may be rejected on mainnet, and vice versa.

Why we say this out loud​

Between April and August 2026 we received the same finding from five independent researchers. Every one of them acted correctly: our public documentation described signature verification as active, nothing public said otherwise, and the only place the testnet configuration was recorded was our private source tree. A researcher had no way to tell an intentional testnet setting from a critical defect, so reporting it was the right call every time.

That was our documentation failing, not their judgement. This page is the fix. If you find something and cannot tell from our public docs whether it is intentional, that is a gap on our side — please ask, and we will answer.

Reporting​

  • security@vexidus.com
  • Check Known Issues first — it lists what we already know about and what is in the pipeline.
  • A finding that reduces to "testnet does not enforce signatures" is already known. A finding that shows mainnet-relevant impact, or a way to break the network beyond the above, is very much wanted.

We do not currently run a paid bounty programme. Reports are triaged and recorded, and if a programme opens, earlier reports are revisited for eligibility. We will not imply otherwise.