Security
BMIC security & smart contract verification
BMIC ships a published smart-contract audit, on-chain-verifiable token and presale contracts, and NIST-standardized post-quantum cryptography at the protocol level. Plus a free wallet vulnerability checker any holder can run on any address.
Smart contract audit
BMIC's presale and token contracts have been audited by an independent third-party security firm. The full audit report is published in PDF and downloadable below — covering attack-surface analysis, access-control review, reentrancy, integer-overflow / underflow, signature replay protection, ownership patterns, and pause / upgrade authority.
Download audit report (PDF) →On-chain contract verification
Verify both contracts directly on Etherscan — no trust required.
Post-quantum cryptography
BMIC is the only active crypto presale implementing NIST-ratified post-quantum cryptography (PQC) at the protocol level. Classical ECDSA signatures — used by Bitcoin, Ethereum, Solana and 99% of crypto today — are mathematically broken by Shor's algorithm on a sufficiently large quantum computer. The U.S. government's NIST PQC standardisation programme ratified replacements (FIPS 203, 204, 205) in August 2024.
- CRYSTALS-Kyber (ML-KEM, FIPS 203) — key encapsulation. Lattice-based; resistant to both Shor's and Grover's algorithms within current PQC threat models.
- CRYSTALS-Dilithium (ML-DSA, FIPS 204) — digital signatures. Replaces ECDSA for transaction authorisation.
- SPHINCS+ (SLH-DSA, FIPS 205) — hash-based signature fallback. Stateless, conservative-security alternative.
- AES-256-PQC — symmetric encryption with key sizes resistant to Grover's algorithm.
- ERC-4337 smart accounts — every BMIC wallet is a smart contract account, not a vulnerable externally-owned account (EOA). Account abstraction allows seamless future signature-scheme migration.
See our deeper technical primer at /quantum-crypto/, the BMIC whitepaper, and the NIST PQC project page.
Wallet vulnerability checker (free)
BMIC ships a free public tool that scans any Ethereum-format public address and reports its quantum-risk grade — based on the signature set in the wallet's transaction history, public-key reuse patterns, and exposure surface.
The tool is free for everyone — no token holding required. Token holders get deeper historical analysis and ongoing monitoring on their primary wallets.
Run the wallet checker →Responsible disclosure / bug bounty
BMIC welcomes responsible security disclosures. Please email security@bmic.ai with the issue, reproduction steps, and your affected scope. We will acknowledge within 72 hours and coordinate disclosure timing.
Verified, responsibly-disclosed vulnerabilities are rewarded under a tiered bounty programme. Critical vulnerabilities affecting custody or signing receive the highest tier. Public disclosure prior to coordinated remediation forfeits the bounty.