---
title: Security on EmpoorioChain — what is real
description: The security properties that exist, the ones that are in progress, and the ones the ecosystem does not claim.
---

# Security — stated plainly

## Chain

- Consensus: Aura (sr25519) + GRANDPA (ed25519). Two validators in one data centre: **fault tolerance is zero**; losing one halts finality. External validators are a mainnet-gate item.
- Runtime upgrades in place with `try-runtime` against real state before each one (208 → 220).
- Governance boundaries: `pallet-gov-boundary` caps any entity at 10 % of effective voting power; `pallet-guardian` holds the emergency brake; treasury spend ≤ 10 % per 365 days.
- Slashing exists; defer 27 eras (< 28-era unbonding so an offender cannot exit first).
- **No external audit has been commissioned.** The mainnet gate requires several.

## Post-quantum

ML-DSA (FIPS 204) is verified inside the runtime (`pallet-pqc-keys`): an account may register a post-quantum key and **seal** itself so classical signatures are rejected; `CheckPqcPolicy` runs first in the signed extra. Consensus remains classical, so "post-quantum chain" is not claimed. Earlier "Kyber/Dilithium everywhere" text was removed.

## Wallet (Eoonia)

Seed encrypted with Argon2id + AES-GCM-256, key in Android Keystore / iOS Keychain; create **and import** go through the vault (the import path once wrote the seed in the clear — a test now fails without the fix). Ledger works; no MPC; `PostQuantumCryptoService` disabled (it XOR-encrypted and called it Kyber). A test forbids any screen from claiming an on-chain record that did not happen.

## Privacy

`pallet-privacy` (ZK transfers) is in a hardening pass after a testnet incident; treat its guarantees as provisional.

## Reporting

Report vulnerabilities through the contact page; the repositories are private today. No bug bounty is funded yet.