Receipts
What we shipped, what broke, what we fixed.
Every line links to its proof: a transaction, a commit or an entry in the public review log. Failed and fixed entries stay on the list. If something has no public proof yet, it is not here.
shippedLive, with its prooffixedA finding, fixedfailed and fixedBroke first, then fixed
| DATE | WHAT | PROOF | STATUS |
|---|---|---|---|
| 2026-10-21 | Collector check (H3), fix 2: a scan limited to the last 7, 30 or 90 days now counts as incomplete history, so H3 never calls a destination unused that an older payment went to. The scan covers everything by default. Client 0.2.5, reported through the bug bounty by @0x123van. | Review log entryChangelog | fixed |
| 2026-10-20 | Bug bounty page live: rewards in ETH, USDT or EPH, tiers set in ETH, and the short link ephemeral.money/security. | Bug bountyChangelog | shipped |
| 2026-10-20 | Collector check (H3), fix 1: every payment address is read, also one a relayer moved a token out of without a transaction of its own, and a history that cannot be read is called incomplete. Client 0.2.4, reported through the bug bounty. | Changelog | fixed |
| 2026-10-11 | EPH contracts deployed: launcher, token, vesting and hook in one transaction. Trading stays closed until the launch transaction. | tx 0xe312…ed23BlockscoutProof Wall | shipped |
| 2026-10-08 | Mainnet rehearsal with a throwaway canary token: one prepared Stealth Buy ran twice, and two payments landed on one one-time address. Fixed with a fresh address guard: the buy now reverts if the address already holds code, ETH or the token. | receipt 1receipt 2commit b333db2Review log | failed and fixed |
| 2026-10-08 | Rehearsal: a second payment was withdrawn to the same fresh address minutes after the first, and H3 did not warn, because the explorer had not indexed the first withdrawal yet. Fixed: history is compared with each address’s nonce, and a lagging explorer counts as incomplete. | commit c64cb7aReview log | failed and fixed |
Newest first. The contracts, live reads and the full review log are on the Proof Wall; every change to the site and the app is in the changelog.
Found something? Security bugs go to the bug bounty. A valid finding lands in the review log and here, with the credit you ask for.