Security and transparency
Your money sits in a contract you can read
When you buy on Bernuvia, Bernuvia doesn't hold your USDC: it sits in a public contract on Polygon until the purchase closes.
The contracts
Everything runs on Polygon mainnet (chain id 137). Every address links to the explorer, where you can read the code and every transaction.
Escrow contract · MarketplaceEscrow v2
Verified codeReceives the buyer's payment and holds it until it is released to the seller or refunded. It is the only place where the money of a purchase lives.
Solidity 0.8.36 with viaIR, optimizer at 200 runs and EVM cancun, built on OpenZeppelin 5.6.1: AccessControl with two-step admin handover, ReentrancyGuard, Pausable, SafeERC20 and EIP-712.
- Network
- Polygon · 137
- License
- MIT
- Compiler
- Solidity 0.8.36
Address
0x9d285aA8a5b24df5eB058D9350dbe33645cd23b5Membership billing · SubscriptionCollector v2
Verified codeCharges the seller membership in USDC with caps set on-chain: at most once per period and always to the treasury.
- Network
- Polygon · 137
- License
- MIT
- Compiler
- Solidity 0.8.36
Address
0xF9f95934fd272481fa205d3B030B5156Ce62A21cUSDC · Circle
Third-party contractThe currency of every purchase: Circle's native USDC on Polygon.
- Network
- Polygon · 137
Address
0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359Read the code, don't take our word
Both contracts have their source code published and verified on the explorer: what runs on the network is exactly what you can read.
- An exact match between the published code and the deployed one.
- MIT license: anyone can read it, copy it and review it.
- The same compiler and the same libraries in both contracts.
What the escrow contract guarantees
These rules are not enforced by a Bernuvia server: they are written in the contract, and anyone can check them in the verified code.
The money never passes through Bernuvia
USDC goes from the buyer's wallet straight into the contract. Bernuvia never holds it.
No arbitrary destinations
The money of a purchase can only go to the seller, minus the fee, which is credited to the treasury, or back to the buyer. The contract admits no other destination.
Everyone withdraws their own
Payments are credited and each party withdraws when they choose. A blocked address cannot jam anyone else's payouts.
The dispute belongs to the buyer
Only the buyer opens a dispute, only the buyer withdraws it and only the buyer closes it when the deadline passes. The seller has no on-chain action over it: they put their side in the case file. And it can only be opened before the automatic release expires, so nobody reopens a purchase that is already closed.
Withdrawing a dispute does not stretch the clock
Whoever withdraws their dispute can reopen it while the original deadline is still alive, and that deadline is not renewed: it is inherited. Each purchase allows at most three openings, so nobody can freeze the money by opening and closing disputes in a loop.
The fee never comes out of your share
In a dispute the fee is the smaller of two numbers: the fee on the amount, or whatever the seller keeps. If the refund is total, the fee is zero.
Signed, single-use quotes
Every price is signed with EIP-712, carries its issue time and its expiry, and works only once.
Audit
The escrow contract went through an adversarial audit before going to mainnet, and a second review with the contracts already in production. That second review produced the version that holds the money today.
Method
- Three independent adversarial reviews, each with its own lens: funds and reentrancy; access control and signatures; state machine and griefing.
- Static analysis with Slither and a funds-conservation invariant over random operations.
- A second review with twelve independent lenses across four rounds, this time against the deployed contracts.
- Conservation invariants checked against a shadow model that redoes the accounting on the side and has to match to the cent.
- Three adversarial lenses over the current version's code before deploying it, with their proofs of concept turned into regression tests.
The numbers
662
automated Hardhat cases, spread across 109 files
105
proofs of concept turned into regression tests
1,600
random operations against the shadow model
15
tests of the membership billing contract
Platform security
Off-chain, what protects your account and your downloads.
- Two-step verification, plus an extra code for sensitive actions: a withdrawal from the panel requires your signature and a code sent to your email.
- MCP and API tokens carry scoped permissions: they can never sign a payment, withdraw funds, or change your email, your password or your two-step verification.
- The treasury is a multisig wallet.
- Sessions expire after inactivity.
- Security headers on every response: CSP with a per-request nonce, COOP and CORP.
- Every download of a file hosted by Bernuvia shows the SHA-256 fingerprint the server computes, or says it isn't available yet.
Report a vulnerability
If you find a security flaw, we want to hear it before anyone else. Here is how:
Write to us through the contact form
Put "Security" in the subject and tell us what you found, how to reproduce it and what impact it has.
If you have an account, use the panel's bug report
The "Report a bug" button in the panel reaches the same team and stays tied to your account.
Give us time to fix it
We confirm receipt and tell you when it is fixed. We ask you not to publish it until then.