OPEN · PRE-MAINNET · INDEPENDENT EYES WANTED
BREAK IT
BEFORE MAINNET.
Most projects ask you to trust the launch. COHIBA is asking you to challenge it first. Review the assumptions, state machine, token invariants, recovery logic, evidence layer and privacy boundaries before anything irreversible happens.
What we want challenged
Launch safety
Unauthorized launch, duplicate mint, concurrency, persistence and recovery.
Token invariants
Exact supply, destination balance, immutable metadata and authority revocation.
Evidence integrity
Can public claims drift away from source, CI or chain evidence?
Web, API & privacy
Origin/rate/path controls, malformed requests and aggregate analytics privacy.
Rules
Do not attack production availability, steal credentials, test third-party infrastructure outside its rules, or attempt Mainnet launch. Use static analysis, local testing and Devnet wherever possible. Sensitive findings should follow SECURITY.md rather than public exploit disclosure.
Recognition
Verified reviewers and contributors can receive public attribution, evidence-log credit, contributor spotlight and consideration for Builder/Trust Ambassador roles.
Financial bounty: no cash/token reward is promised until a funded amount and payment terms are publicly posted. We will not advertise an unfunded bounty.
What success looks like
A real weakness is found, reproduced and fixed.
A useful test, patch, review or evidence improvement is merged.
A qualified third party reviews a defined commit and scope.
The project becomes more independently verifiable before Mainnet.
Start here
Independent Review Package ↗
Threat Model ↗
Verification Specification ↗
Evidence Log ↗
Share the review
Bring adversarial eyes
Share the campaign with engineers and reviewers using the tracked X source.
Send engineers to scoped issues
Five review targets are already open so contributors can start immediately.
Technical discussion link
Use this tracked URL when sharing in relevant Solana engineering/community channels.
Independent review link
Use the dedicated source link for audit/security outreach.
Mainnet remains locked
This campaign is a review campaign. It does not authorize Mainnet launch, liquidity creation or any irreversible token operation.