Security

Amir Ramy Chatbi, known as Slashy, is the founder of Styx Protocol and its security lead.

Security at Styx is founder-led: one person, with no separate security team. The security lead decides what is tested, reviews every finding and signs off every fix before it ships.

Write to the security lead. Describe the issue, how to reproduce it and what it affects. If your report holds details you would rather not send by plain email, say so in a short message and ask for another channel.

Security contact: amirramy.chatbi@protocol-01.dev

Test only on Solana devnet, with your own wallets and test SOL. Never against another person’s funds, balance or wallet.

There is no paid bug-bounty programme today.

In scope: the Styx programs on Solana devnet, the payment circuits and the proof verifier, our relayer, the apps at styx.cash and protocol-01.dev, and the SDKs we publish.

Out of scope: services run by others, such as RPC providers and wallet extensions.

Each phase of the work ends with an internal attack test in which a payment receiver tries to find the payer. The third of these tests, on 2026-10-07, found no link between payer and payee beyond the accepted timing and amount limits.

Styx has not been externally audited. It runs on Solana devnet only, with test SOL, and there is no mainnet deployment. An external review comes before mainnet.