Skip to main content

​
Threat Model

Centrix is designed to resist a range of potential attacks from rational and irrational adversaries.
Security Transparency: While no system can guarantee absolute security, this document provides full transparency into our threat model, identified attack vectors, and comprehensive mitigation strategies. We prioritize honest communication about security limitations and continuous improvement.

​
Attack Vectors & Mitigations

Sybil Attacks

Threat: Attacker creates multiple identities to manipulate reputation or votingMitigation:
  • Stake requirement to join network
  • Proof-of-work for identity registration
  • Slashing mechanisms for malicious behavior
  • Reputation decay for new accounts
Threat: Provider submits false computation results to earn CXT dishonestlyMitigation:
  • Redundant execution on multiple providers
  • Zero-knowledge proof verification
  • Merkle proof spot-checking
  • Reputation-based filtering
Threat: Attacker isolates nodes from honest network participantsMitigation:
  • Random peer selection
  • Multiple connection paths
  • Rate limiting on peer connections
  • Incentivized relay nodes
Threat: Attacker submits impossible tasks to waste provider resourcesMitigation:
  • Collateral requirement for task submission
  • Resource limits per task
  • Timeout mechanisms
  • Quality reputation for requestors
Threat: Attacker controls majority of voting power to change protocolMitigation:
  • Token distribution across many parties
  • Quorum requirements for governance
  • Timelock on major changes
  • Community emergency pause mechanism

​
Cryptographic Guarantees

Computation Integrity

Zero-knowledge proofs verify computation correctness without reexecution

Data Confidentiality

End-to-end encryption ensures only authorized parties access task data

Authentication

Digital signatures prove identity and authorize transactions

Non-Repudiation

Blockchain records permanently log all transactions and disputes

​
Verification Methods

​
Multi-Tiered Verification

Redundant Execution

Same task runs on 2-3 independent providers. Results must match.

ZK Proofs

Cryptographic proof that computation was done correctly without revealing details

Spot Checking

Random audits of provider work to catch systematic fraud

​
Economic Security

Staking & Slashing:
  • Providers must stake tokens proportional to task value
  • Fraudulent results result in stake loss (slashing)
  • Higher stakes for higher-value tasks
  • Reputation penalties compound economic damage
Example:
  • Task value: 100 CXT
  • Provider stake requirement: 50 CXT (50%)
  • False result: Lose 50 CXT stake + reputation damage
  • Honest result: Earn 50 CXT payment + reputation boost
Aligned Incentive Structure: The Centrix protocol employs game-theoretic economic mechanisms that ensure honest behavior consistently yields higher long-term profits than malicious actions, creating a self-reinforcing system of trust.

​
Incident Response

​
Security Incident Process

  1. Detection - Monitoring systems identify anomalies
  2. Analysis - Security team investigates root cause
  3. Containment - Affected accounts/nodes quarantined
  4. Recovery - Legitimate transactions restored/compensated
  5. Post-Mortem - Public disclosure and protocol improvements

​
Emergency Mechanisms

Governance can activate emergency pause to halt all transactions during critical security issues.

​
Security Audit Status

Planned Q2 2026

Third-party security audit by leading blockchain security firm

Bug Bounty Program

Reward researchers for discovering vulnerabilities responsibly

​
Best Practices for Users

​
For Providers

  • ✅ Keep node software updated
  • ✅ Use strong passwords/key management
  • ✅ Monitor reputation score regularly
  • ✅ Run on isolated/dedicated hardware
  • ❌ Don’t share private keys
  • ❌ Don’t accept risky/unverifiable tasks

​
For Requestors

  • ✅ Use trusted wallet software
  • ✅ Verify provider reputation before submitting sensitive work
  • ✅ Use encryption for sensitive task data
  • ✅ Monitor account activity
  • ❌ Don’t submit proprietary algorithms unencrypted
  • ❌ Don’t trust new/unknown providers with critical tasks