IoTeX has published a formal vulnerability disclosure policy for its Layer 1 blockchain, establishing clear rules for how independent security researchers can report flaws they find in the network. The move invites outside scrutiny of a system the project says has been running since its 2019 mainnet launch, aiming to formalize what had previously been an informal or ad hoc process for surfacing bugs.
What the policy covers
The new framework sets out a defined scope of systems researchers are permitted to test, with activity directed toward IoTeX's developer network rather than the live production chain. That distinction matters: testing on a developer network lets researchers probe for weaknesses without risking disruption to real transactions, smart contracts, or user funds running on the main chain.
The policy also includes a private reporting channel, meaning researchers can disclose a discovered issue directly to IoTeX's team rather than posting it publicly, where it could be exploited before a fix is ready. This kind of coordinated, or "responsible," disclosure process is standard practice across much of the software industry and is increasingly common among blockchain projects as they mature.
Safe harbor and researcher credit
A notable element of the announcement is the inclusion of safe-harbor protections for researchers who follow the policy's rules. Safe-harbor language is intended to give security researchers legal assurance that good-faith testing and reporting, conducted within the stated scope, will not result in legal action against them. This kind of protection has become a common request from the security research community, which has historically been wary of engaging with organizations that might otherwise treat vulnerability testing as unauthorized access.
IoTeX's policy also commits to public credit for researchers who identify and report valid issues, a practice that gives contributors professional recognition even when no monetary bounty is involved. The announcement did not specify whether a paid bug bounty program accompanies the policy, so readers should treat the initiative, based on available information, as a disclosure and recognition framework rather than a confirmed paid rewards program.
Why this matters for a Layer 1 network
IoTeX positions itself as a blockchain platform built for Internet of Things applications, combining a main "root" chain with sub-blockchains designed to handle device-specific transactions. Because the network is intended to support connected hardware and decentralized applications at scale, vulnerabilities in its core protocol could have outsized consequences compared to issues in a single application built on top of it.
Formalizing a disclosure process is a practical governance step rather than a technical upgrade: it does not by itself make the network more secure, but it creates a structured, lower-friction path for outside experts to report weaknesses before they are discovered by bad actors. For enterprise and developer audiences evaluating blockchain infrastructure, the presence of a clear, safe-harbor-backed disclosure policy is often viewed as a baseline indicator of operational maturity rather than a guarantee of a flawless system.