Security Threat model · rotation · audit.

Threat model

HelixKey defends against six documented threats:

1. Seed-phrase theft
2. Biometric database breach
3. Coerced enrollment
4. Compromised device
5. Quantum key recovery
6. Cross-chain replay

Interactive attack simulator with animated visualizations: /protocol/security/.

Rotation

Rotation is a first-class primitive. A rotation intent locks the old anchor in "pending-rotation" state; the old key stays valid for a bounded grace window (default 24h); after grace, the old key is permanently retired. The HelixIdentity object persists — only the key rotates.

SlowMist audit

SlowMist audited the four Move modules in May 2026. 21/21 checklist items passed on first review. Full report available on request. Interactive checklist: /protocol/security/.

Responsible disclosure

Bug bounty: $100 to $100,000, four severity tiers. Disclose privately to [email protected]. See bug bounty page for tier details.