This project implements cryptographic, security-sensitive functionality (ElGamal/AES key handling and zero-knowledge proofs for Token-2022 Confidential Transfers). We take security reports seriously and appreciate responsible disclosure.
Note: This SDK runs end-to-end on devnet and against a local validator. It is self-audited, not independently audited. It depends on Solana's ZK ElGamal Proof Program being enabled on the target cluster. Review the status notes in the README before relying on it on mainnet-beta.
| Package | Version | Supported |
|---|---|---|
@softseco/confidential-transfers (TypeScript) |
3.x |
✅ |
@softseco/confidential-transfers (TypeScript) |
2.x |
❌ (upgrade; the API is the same) |
@softseco/confidential-transfers (TypeScript) |
< 2.0 |
❌ |
softseco-confidential-transfers (Rust) |
2.0.x |
✅ |
softseco-confidential-transfers (Rust) |
< 2.0 |
❌ |
Security fixes land on the latest release of each package.
2.0.0 changed key derivation to the ecosystem standard. Keys derived by 1.x are different, so
the balance of an account configured under 1.x has to be moved out with 1.x before upgrading;
see CHANGELOG.md.
Please do not open a public GitHub issue, pull request, or social post for security reports.
Instead, use one of:
- GitHub private vulnerability reporting (preferred) — on the repository, go to the Security tab → Report a vulnerability. This opens a private advisory with the maintainers.
- Email — contact the maintainer at hello@softseco.com with the details.
Please include, where possible:
- A description of the issue and its potential impact
- Steps to reproduce or a proof of concept
- Affected version(s) and environment (cluster, Node/Rust versions)
- Any suggested remediation
- We aim to acknowledge a report within 72 hours.
- We'll work with you to understand and validate the issue, and keep you updated on remediation.
- Once a fix is released, we're happy to credit you in the advisory unless you prefer to remain anonymous.
Thank you for helping keep the ecosystem safe.