Molecule Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: false
policy:
  - https://docs.molecule.xyz/security/bug-bounty
security_pages:
  - https://docs.molecule.xyz/security/bug-bounty
  - https://docs.molecule.xyz/security/audits
audits:
  - firm: Cyfrin
    date: '2026-05-12'
    scope: OnChainLab (Molecule Labs core) — modular Lab smart-account stack (ERC-4337/6551/7579/7739/1271), OnChainLabFactory, LabNFT, ERC-7484 module registry, RootValidator, DID registry, OdfCoAttestVerifier.
    report: https://github.com/Cyfrin/cyfrin-audit-reports/blob/main/reports/2026-05-12-cyfrin-molecule-onchainlab-v2.0.pdf
  - firm: Pashov
    date: '2023-Q1'
    scope: Molecule Vesting (Token Vesting)
    report: https://github.com/pashov/audits/blob/master/solo/pdf/MoleculeVesting-security-review.pdf
  - firm: Pashov
    date: '2023-Q2'
    scope: IP-NFTs & Fundraises (CrowdSale, Fractionalizer/Tokenizer, TimelockedToken)
    report: https://github.com/pashov/audits/blob/master/solo/pdf/IPNFT-security-review.pdf
evidence:
  - {source: https://docs.molecule.xyz/security/bug-bounty, kind: bug-bounty-page}
  - {source: https://docs.molecule.xyz/security/audits, kind: security-audits}