Security: category-labs/monad

Security

Report a vulnerability

SECURITY.md

SECURITY.MD

Third Party Security Audits

Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.

As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.

Reporting a Vulnerability

We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.

Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.

DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.

For other security-related reports, you may email us at: security@category.xyz.

Please include the following information in your report:

  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications

Scope Limitations

The following issues are considered outside the scope of our vulnerability disclosure program:

  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities

Contact Information

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: category-labs/monad
Security
Report a vulnerability

SECURITY.md

SECURITY.MD
Third Party Security Audits
Category Labs engages third party audit firms to conduct independent security audits of their implementation of the Monad client. At any given time, multiple audit streams can be in progress.
As these third party audits are completed and issues are sufficiently addressed, we make those audit reports public. Audits can be found in the monad-audits repository.
Reporting a Vulnerability
We are committed to maintaining the security and integrity of our codebase and appreciate the security research community’s efforts in helping us achieve this goal. If you believe you have discovered a security vulnerability in our codebase, we encourage responsible disclosure.
Please follow the disclosure requirements listed in the public Cantina bug bountyto be considered eligible for a bug bounty.
DO NOT report critical security vulnerabilities through public channels, including GitHub issues or public forums.
For other security-related reports, you may email us at: security@category.xyz.
Please include the following information in your report:
  • Detailed description of the vulnerability
  • Step-by-step reproduction instructions
  • Assessment of potential security impact and exploitation scenarios
  • Proof-of-concept code or exploit demonstration (if applicable)
  • Your preferred contact information for follow-up communications
Scope Limitations
The following issues are considered outside the scope of our vulnerability disclosure program:
  • Social engineering or phishing attacks
  • Physical security vulnerabilities
  • Denial of service (DoS) attacks
  • Vulnerabilities in third-party dependencies (except where they create a protocol-level security issue)
  • Issues requiring unauthorized physical access to systems or infrastructure
  • Theoretical vulnerabilities without demonstrated exploitation paths
  • Vulnerabilities related to smart contracts, dApps, or anything else not included in this codebase
  • Previously reported and acknowledged vulnerabilities
Contact Information
 There aren't any published security advisories