MPC Cryptography Library

Bron never holds or controls user private keys, funds, or assets. All transactions are user-initiated and executed directly with third-party smart-contract protocols. Swap and staking functions are performed via independent third-party APIs. Bron only provides technical access and does not pool, intermediate, or custody user assets.

Every accepted bounty submission entitles the researcher to a non-transferable Bron NFT in addition to the monetary reward listed below. The NFT grants a complimentary Basic tier subscription for 2026 (or an upgrade to the next tier if Basic is already active, capped at Enterprise). To receive any reward, a Bron wallet is required — bounty payments are distributed in stablecoins to the researcher's Bron wallet address.

If a vulnerability is complex or cannot be properly assessed using CVSS v4.0 metrics, the reward assessment will be conducted individually based on expert evaluation by the core development team.

Cryptographic vulnerabilities in MPC libraries often involve complex interactions between mathematical primitives, protocol implementations, and security properties that may not map cleanly to standard CVSS scoring. In such cases, our security team will evaluate the vulnerability based on:

• Potential impact on threshold signature security
• Exploitation complexity and feasibility
• Affected components and their criticality
• Business and security context
• Novelty and research value of the finding

The final reward amount will be determined through careful expert analysis, ensuring fair compensation for valuable security research while maintaining consistency with our overall bug bounty program structure.

If the PoC demonstrates direct impact on threshold signature security, key generation flaws, or protocol-level vulnerabilities, our security team may apply an increased reward within the specified ranges.

All bounty payments are made in USD-denominated stablecoins to the researcher's Bron wallet address and are subject to sanctions screening and anti-money-laundering controls consistent with Bron's compliance policy. Rewards cannot be paid to individuals or entities on applicable sanctions lists.

• In Scope: Threshold signature schemes and their direct or indirect dependencies, cryptographic implementation flaws, memory safety issues, logic errors in threshold signature schemes, issues in key generation/signing/verification protocols, vulnerabilities in BoringSSL integration
• Out of Scope: Side-channel vulnerabilities (timing attacks, etc.), experimental features that are not dependencies of threshold signature schemes, vulnerabilities in third-party dependencies (unless they create bron-crypto-specific security issues), availability and denial-of-service findings (including Go panic/crash bugs triggered by malformed input — the MPC library threat model assumes authenticated participants and focuses on confidentiality and integrity of threshold signatures; process crashes are expected boundary conditions in the no-honest-majority setting)