XE Security
Trust nothing. Check everything.
Nobody on XE has to be trusted: not the machines, not their owners, not the customers. Every block is signed and checked by every node, every job gets only the access it declares, and every payment waits in escrow until the work is done.
Nobody on XE has to be trusted. Everything anyone claims, about money, hardware, time or code, is signed, measured or held until it’s proved.
Most networks ask you to trust someone: the validators, a cloud provider, the platform in the middle. XE is designed so the question doesn’t come up. An account is a key. A block is only valid if that key sealed it with XE Signatures, and every node checks it before passing it on.
The same idea runs all the way up. Machines prove what their hardware can do with the XE Benchmark. XE Timekeepers witness how long work ran. Jobs declare what they need and get nothing more. Payment sits in escrow until the seconds are delivered. Where something can’t be proved yet, we say so.
An account is a key. Only its seal can add a block, and every node checks it.
Each job runs in its own virtual machine, with only the access it declared.
The budget waits in escrow and is released per second of work delivered.
Change one byte.
Watch every node refuse it.
A block carries its own proof. Tamper with this one any way you like: these are the checks every node on XE runs before it passes a block on.
- type
- send
- network
- mainnet
- account
- 60fb69a9b8…3a2492
- previous
- ff90043bdf…967c6d
- balance
- 4500
- destination
- 4afca6926e…f2b3ca
- amount
- 500
- timestamp
- 2026-09-23T10:41:07Z
- 01FingerprintThe block still matches the fingerprint it was sealed with
- 02SignatureXE Signatures: sealed by the account’s own key
- 03Proof of workXE Proof of Work: the moment of computing is there
- 04TimestampWithin an hour of the node’s own clock
- 05ChainFollows the account’s last block, and the balance adds up
Six layers. None of them
takes anyone’s word.
From the keys at the heart to the payments at the edge, every layer checks what it’s handed and assumes nobody is honest.
Every block sealed by its owner’s key.
Nothing home-grown and nothing exotic. XE Signatures seal every block, vote and record with its owner’s key, and any node can check the seal without ever seeing the key. The wallet in your browser checks every signature exactly as a node does.
Every attack we plan for,
and what stops it.
Written the way an attacker would think about XE. If you can find one that isn’t here, we’d like to hear about it first.
- Spend from someone else’s accountEvery block must be sealed with the account’s own key, and every node checks the seal.Ledger
- Edit a block already on the chainEach block is sealed over its fingerprint and names the block before it. Change one byte and nothing lines up.Ledger
- Replay a block on another networkThe network’s own ID is sealed into every block. Anywhere else, it doesn’t check out.Ledger
- Flood the network with junk blocksEvery block carries XE Proof of Work, about a second of computing. Nothing for a payment, expensive at spam volumes.Ledger
- Spend the same money twiceTwo blocks at one place start a vote. 67% of delegated weight confirms one, and the other is rejected everywhere.Consensus
- Move delegation mid-vote to swing itWeights are frozen the moment a conflict is detected, and the vote is counted against that snapshot.Consensus
- Race the network so nodes back different blocksEvery honest representative backs the same block by the same fixed rule, whatever order the blocks arrived in.Consensus
- Change a vote after seeing the othersOne vote per representative per conflict. Anything after the first is ignored.Consensus
- Stall a conflict by staying offlineAfter 10 seconds, a unanimous vote among those who did vote settles it.Consensus
- Read or alter traffic between nodesEvery link on the XE Mesh is encrypted, and every node has a lasting identity of its own.Network
- Exhaust a node’s memory with huge messagesHard size limits on every kind of message a node accepts, and on every answer it gives.Network
- Use catch-up requests to flood a victimNodes don’t answer unknown requests with whole chains, and each peer can ask only every few seconds.Network
- Waste a node’s time with malformed messagesEvery message is checked for size and shape before any expensive work, and anything unexpected is refused.Network
- Break out of a job into the owner’s machineEvery lease runs in its own virtual machine, sealed from the owner’s files and from other leases.Compute
- Reach more of the internet than declaredA job gets only the access it declared, and only on machines whose owners allow it.Compute
- Ship something malicious as a contract or imageEverything is reviewed against what it declares before any machine owner is offered it.Compute
- Claim a faster machine than you haveXE Benchmark certificates can’t be worked out in advance or borrowed from elsewhere, and lapse after seven days.Compute
- Fake how long a job ranStart and end are witnessed by XE Timekeepers, two of three agreeing.Compute
- Fake uptime with a friendly customerWhat a machine earns is set below what the work costs, so faking it together loses money.Compute
- Steal the key that proves uptimeProtecting keys inside leased machines is on the must-fix list for production.Compute
- Take the money and not do the workPayment waits in escrow and is released only for seconds of work delivered.Payments
- Charge more than was agreedEscrow is a hard ceiling. Nothing beyond the budget can be spent.Payments
- Drain a treasury with one stolen keyShared accounts need several keys to spend anything.Payments
What the network guarantees.
And what it can’t.
The network makes sure you get what you pay for, and that a stranger’s job can’t touch your machine. It can’t make someone else’s hardware private, and nobody honest would tell you it could.
- 01You pay for delivered secondsEscrow releases payment for every second of work. If the machine drops off, payment stops with it.
- 02Your budget is a ceilingEscrow can’t be overspent, so nobody, human or agent, runs up a bill you didn’t agree to.
- 03The hardware is what it saysEvery machine carries an XE Benchmark certificate that can’t be faked or borrowed, valid for seven days.
- 04The clock isn’t the owner’sWhen work started and ended is witnessed by XE Timekeepers, not taken from the machine.
- 05The owner’s machine is untouchedEvery job runs sealed in its own virtual machine, and reaches only what it declared and the owner allows.
The owner of a machine can read what runs on it. As with any server you don’t own.
- Keep secrets off itPrivate keys, credentials and confidential data don’t belong on a rented machine.
- Encrypt what you storeStorage jobs keep data encrypted, so the owner holds it without being able to read it.
- Use your own hardwareFor work that must stay private, run it on an XE Net: machines you control, joined into one network.
Don’t take our word for it.
Check a block yourself.
A block carries everything needed to check it. Fetch any block or account from any node, and check it the same way every node does, with nothing but the account’s address. The docs show exactly how.
1export XE_NODE=https://ldn.core.test.network23# any block, by its fingerprint4curl $XE_NODE/blocks/<hash>56# {7# "type": "send",8# "account": "68fb69a9b8…3a2492",9# "previous": "ff90043bdf…967c6d",10# "amount": "500",11# "hash": "4f19ac6d0f…525bc73caa",12# "signature": "edc90fdd27…8960fc"13# }
What isn’t solved yet.
Every network has open problems. These are ours, taken from our own threat analysis, with what’s being done about each.
XE Uptime Proofs are signed with a key that lives in the leased machine. Our own threat analysis rates protecting it as critical, and a must-fix before production.
Witnessed times may be up to ten minutes apart. Taking the middle of a majority stops one bad timekeeper, but ten minutes matters on a lease shorter than an hour.
An owner who accepts work and abandons it loses less than the customer it lets down, about one to five. Stronger settlement is planned to close the gap.
When two nodes catch each other up, each learns which accounts the other holds and how far along they are. A more private exchange is planned.
Work runs on someone else’s hardware. Contracts and images say so up front, and nothing secret belongs on a rented machine.
Machine and customer both sign a heartbeat every minute, folded into one small claim for a whole day. XE Timekeepers cover timing until it ships.
Attacked by its own team, release by release.
Designs are published with a red-team threat analysis: each attack, how severe it is, and whether it’s mitigated, must be fixed, or not yet addressed. Every release lists what it hardened.
Found something?
Tell us first.
Researchers are the reason networks hold up. Report privately, give us time to fix it, and valid reports are rewarded according to impact.
- 1Write to security@xe.networkPrivately. Not a public issue, not a post, and not a proof of concept run against someone else’s machine.
- 2Show us how to see itWhat you found, where, and the steps to reproduce it. A testnet node or your own machine is the place to try.
- 3Give us time to fix itWe’ll work on it with you, and keep you posted, before anything is made public.
- Moving funds out of an account without its key
- Getting both sides of a double spend confirmed
- Minting XE, or releasing escrow, for work that wasn’t done
- Escaping a job’s isolation onto the owner’s machine
- Nodes disagreeing on a confirmed block
- Stopping conflicts from resolving
- Forging XE Timekeepers’ records or XE Benchmark certificates
- A job reaching past the access it declared
- Crashing or stalling a node remotely
- Getting around a node’s size or rate limits
- Making a peer do far more work than you do
- Leaking more about accounts or peers than the docs say
- Weaknesses that need an unlikely setup to exploit
Out of scope: the open problems listed on this page, social engineering, denial of service by sheer volume, and anything tested against machines or accounts that aren’t yours.
Straight answers.
What researchers, operators and customers ask before they trust a network.
How is XE secured?
Every block on XE is sealed with its account’s key and checked by every node before it’s passed on. XE Consensus only runs when an account signs two blocks for the same place, and 67% of delegated weight decides. Links between nodes are encrypted, jobs run sealed with only the access they declare, and payments wait in escrow until the work is done.
How are blocks protected?
With XE Signatures: every block, vote and record is sealed by its owner’s key, and carries a fingerprint of its contents that no longer matches if anything changes. They’re built on standard, well-studied cryptography, checked the same way by every node and every wallet. The docs cover exactly how.
How does XE stop double spending?
If an account signs two blocks for the same place in its chain, every node records a conflict and freezes the representatives’ weights. Every honest representative backs the same block by the same fixed rule, and once one block holds 67% of the weight it’s confirmed everywhere and the other is rejected.
If there are no fees, what stops spam?
XE Proof of Work: every block carries about a second of computing. That’s nothing for a real payment, and expensive at the volumes spam needs.
Can a job on my machine read my files?
No. Every job runs in its own virtual machine, sealed from your files, your other programs and other customers’ jobs. It gets only the network access it declared, and only if your policy allows it.
Can the owner of a machine see my data?
Yes, in principle. A rented machine is someone else’s hardware, and its owner can read what runs on it, as with any server you don’t own. Keep private keys and confidential data off rented machines, and run sensitive work on an XE Net of machines you control.
How do I report a vulnerability?
Email security@xe.network privately, with what you found and how to reproduce it. Don’t post it publicly, and don’t test it against machines or accounts that aren’t yours. We’ll work on it with you and keep you posted before anything is made public.
Are security reports rewarded?
Yes. Valid reports are rewarded according to their impact, from critical issues that put funds or keys at risk down to hardening.
What happens if I lose my key?
Whoever holds an account’s key controls it, and nobody else can recover a lost one. Back up your seed. For teams and treasuries, a shared account needs only some of its keys, so one lost key doesn’t lock you out.