Two audits.Zero critical.
Coinsult and Certik reviewed every line of contract before it touched mainnet. Our team is KYC-verified by AssureDeFi. All reports are public.
Names you can google in five minutes.
Independent security reviews and identity verification you can check yourself.
Full transparency. Verify yourself.
All audit reports and KYC verification are publicly available. Don't trust, verify.
No critical vulnerabilities were found in any audit. Full reports are available for public review.
Find a bug. Take the bounty.
Five severity tiers. Real payouts. Same day response, even if it lands at 2am.
Loss of funds. Treasury drain. Total chain halt.
Sig replay. Re-entrancy. Bridge race.
DoS. Oracle staleness. Reward rounding.
Gas griefing. UI spoofing. Event omission.
Style. Docs. Best-practice nudges.
Send us the details and a proof-of-concept. We reply within the hour, even at 2am.
No submissions yet. Be the first to find a vulnerability and earn a bounty.
How to tell us you found something.
Find
A bug in contract, bridge, or wallet flow. Reproducible in a test.
security@earthmeta.ai · PGP signed if possible. We confirm within the hour.
Triage
Severity assigned. Bounty quoted. Patch branch opened.
Patch
Code merged. Re-audited if severity >= medium.
Ship
Time-locked upgrade. Disclosure goes public. Bounty pays out.
Your half of the floor.
Security is a shared job. We lock down the protocol; these six habits lock down your side. Give them two minutes.
Verify the URL
The only real site is earthmeta.ai: nothing else. We never use Punycode look-alikes or “.io / .app” clones. Bookmark it and open EarthMeta only from that bookmark.
Read every prompt
Every wallet prompt shows the exact spend and the exact target. If a MetaMask prompt asks for more than you expect, decline it; you can always try again.
Backup your passkey
Keep two devices with two passkeys. We can never recover your keys; only your wallet provider can, so set up your backup before you ever need it.
Use a hardware key
For any wallet holding more than 5,000 EMT, use a Ledger or Trezor. Your keys stay offline, out of reach of malware.
Revoke approvals
Every quarter, run a /revoke audit. The fewer contracts that can move your funds, the smaller your attack surface.
Beware DMs
We will never DM you first.Anyone offering “support”, giveaways or “validation” in your DMs is a scammer; ignore and block.
The slightest doubt? Just ask us. The chat box in the corner is on every page of the site; if a link, a prompt or a message feels off, check with us before you sign anything.
Find it.
Take the bounty.
Help us keep EarthMeta safe. Every valid submission gets a response within the hour.
