Independent security research · Vulnerability research · Smart contract review · Coordinated disclosure
We find exploitable bugs, prove them, and report them so they get fixed.
We research software, network-facing products and DeFi protocols; write each finding up with a root cause and a working proof of concept; and report it privately, to the vendor or through the Zero Day Initiative, Cantina or Immunefi.
Submissions to date
Counts only. Details are published after a fix is available or the disclosure window has closed.
Findings go through established disclosure programs, which triage each report and coordinate with the affected vendor or protocol team.
| Platform | Targets | Submissions |
|---|---|---|
| Zero Day Initiative Trend Micro | Software, applications, network-facing products | 26 |
| Cantina | Smart contracts, DeFi protocols | Multiple |
| Immunefi | Smart contracts, DeFi protocols | Multiple |
These are submissions, not outcomes. We don’t list CVEs, vendors or payouts here, and nothing under embargo is ever listed anywhere on this site.
What we do
Each engagement ends in a written report you can hand to an engineer and act on.
-
01
Vulnerability research
Exploitable bugs in native code, browsers, desktop applications and network services: the kind of target the Zero Day Initiative covers. Every finding is delivered with a root-cause analysis and a working proof of concept.
Deliverable root cause + proof of concept
-
02
Smart contract reviews
Solidity contracts and protocol designs, reviewed for logic errors, access-control gaps and economic attacks. Findings are ranked by what an attacker could actually do with them, and each comes with a test case that reproduces it.
Deliverable ranked findings + reproducing tests
-
03
Disclosure support
Help getting a finding to the right person at the vendor, agreeing a realistic remediation timeline, and writing an accurate advisory once the fix has shipped.
Deliverable coordinated timeline + advisory
Say what you’re building, what’s in scope and when you need it. We’ll tell you plainly whether it’s a fit.
Every finding is verified with a minimal proof of concept and reported privately, either to the vendor’s security contact or through the program that covers it. When a report goes through a program, that program’s rules on timing and publication apply.
- Day 0Vendor notified privatelyAffected versions, impact, root cause, steps to reproduce.
- Day 7If actively exploitedThe window may shorten to 7 days. We tell the vendor before doing so.
- Fix shipsUsers get time to updateTypically up to 30 days, then we publish.
- Day 90Default publicationExtended for vendors who are working on a fix and keeping us informed.
- +14 daysGrace periodUp to 14 days if a fix is scheduled to ship just after the deadline.
Advisories are written for defenders: enough to understand and verify the issue, and no more. Smart contract testing happens on local forks and testnets, never against live deployments. We don’t sell vulnerabilities to buyers who would keep them unpatched, and we don’t test systems we aren’t authorized to test.
If you’ve received a report from us
- It’s complete. Affected versions or deployments, impact, root cause and steps to reproduce, so you can confirm and fix the issue without a call.
- It’s private. Nothing is published before a fix is available unless the timeline above runs out.
- We’ll work with you. Tell us your remediation plan and we extend the window. We coordinate publication timing and credit.
- It comes from an @copperfault.com address. To confirm a report is genuine, or to reach us about one, write to security@copperfault.com.
Two addresses
One for security reports, one for everything else.
Vulnerabilities in our own systems, or coordination on a finding that affects something we’ve also reported. Please read the disclosure policy first; good-faith research on our systems is covered by its safe harbor.
Machine-readable contact: security.txt
Research engagements, smart contract reviews or help with a disclosure. Say what you’re building, what’s in scope and when you need it.
Currently open to new engagements