Security at bonuz
bonuz is the Human Layer protocol — and security is its foundation. Every protocol, smart contract, and piece of infrastructure we use is audited, battle-tested, or trusted at scale by tens of millions of users.
- Core protocols audited by Hacken (score: 10/10).
- ERC-4337 account abstraction powered by Biconomy.
- Infra providers audited by top firms like Trail of Bits, Quantstamp, Halborn, OpenZeppelin, and others.
All Bonuz Inc. (St. Lucia) core protocol contracts — the DNFT protocol and Social Oracle protocol — have been independently audited by Hacken, with a 10/10 result.
The audit covers:
- DNFT lifecycle safety (issue → active → redeem → expire).
- Social Oracle permission and event logic.
- On-chain attestation and identity record updates.
- Anti-fraud protections for redemptions and state changes.
- Integration points for account abstraction and paymasters.
bonuz relies on infrastructure that powers major Web3 wallets, exchanges, and protocols. These providers undergo regular audits by top-tier cybersecurity firms such as Trail of Bits, Quantstamp, Halborn, OpenZeppelin, SlowMist, Hacken, Sigma Prime, CertiK, and others.
bonuz uses ERC-4337 smart accounts powered by Biconomy for execution. This enables smart accounts, paymasters, gas sponsorship, bundling, and session keys, while keeping users fully self-custodial.
Key principles:
- Smart accounts are self-custodial; users remain in control.
- Paymasters sponsor only selected, capped bonuz ecosystem actions.
- Bundling and validation go through audited entry points.
- Session keys are scoped and revocable.
To protect the integrity of the Human Layer, we apply:
- Continuous monitoring of protocol events and critical metrics.
- Anomaly and fraud detection for suspicious patterns.
- Secure QR/NFC flows with anti-double-spend protections.
- Rate limiting and guardrails for sensitive actions.
For identity and data:
- Permissioned Social Oracle reads and writes.
- User-controlled visibility and scopes on identity records.
- Regular internal reviews for new protocol versions.
- Threat modeling before major upgrades.
Even though bonuz feels "Web2-simple," users remain fully sovereign:
- Assets are held in self-custodial smart accounts.
- No centralized custody or pooled user funds.
- Every action is on-chain and transparent.
- Identity data and attestations are permissioned and user-controlled.
The Human Layer must be safe, reliable, and sovereign. If it isn't secure, it doesn't ship.
bonuz exists to make blockchains usable for normal people and brands, without giving up the core promise of Web3: self-custody over money, identity, passes, and reputation.