Independent vulnerability research and smart contract review.
Copperfault finds exploitable bugs in software, network-facing products and smart contracts, writes each one up with a root cause and a working proof of concept, and reports it privately: to the vendor, or through the Zero Day Initiative, Cantina or Immunefi.
Found a vulnerability in our systems? Read the disclosure policy. Anything else: hello@copperfault.com.
Record
Findings go through established disclosure programs, which triage each report and coordinate with the affected vendor or protocol team.
| Platform | Targets | Submissions |
|---|---|---|
| Zero Day Initiative Trend Micro | Software, applications, network-facing products | 26 |
| Cantina | Smart contracts, DeFi protocols | Multiple |
| Immunefi | Smart contracts, DeFi protocols | Multiple |
These are submissions, not outcomes. Details are published only after a fix is available or the agreed disclosure window has closed.
Services
Vulnerability research
Exploitable bugs in native code, browsers, desktop applications and network services: the kind of target the Zero Day Initiative covers. Every finding is delivered with a root-cause analysis and a working proof of concept.
Smart contract reviews
Solidity contracts and protocol designs, reviewed for logic errors, access-control gaps and economic attacks. Findings are ranked by what an attacker could actually do with them, and each comes with a test case that reproduces it.
Disclosure support
Help getting a finding to the right person at the vendor, agreeing a realistic remediation timeline, and writing an accurate advisory once the fix has shipped.
Disclosure
Every finding is verified with a minimal proof of concept and reported privately, either to the vendor’s security contact or through the program that covers it. When a report goes through a program, that program’s rules on timing and publication apply.
Otherwise the default is public disclosure 90 days after the vendor is first notified. That gets extended for vendors who are working on a fix and keeping us informed, and may be shortened to 7 days if the bug is being actively exploited. Advisories are written for defenders: enough to understand and verify the issue, and no more.
Smart contract testing happens on local forks and testnets, never against live deployments. We don’t sell vulnerabilities to buyers who would keep them unpatched, and we don’t test systems we aren’t authorized to test.
Contact
Security reports
Vulnerabilities in our own systems, or coordination on a finding that affects something we’ve also reported. Please read the disclosure policy first.
Engagements and everything else
Research engagements, smart contract reviews or help with a disclosure. Say what you’re building, what’s in scope and when you need it.
Currently open to new engagements.