Skip to main content
Cosmic Signature
Trust

Security

Cosmic Signature is a procedural on-chain art protocol on Arbitrum. Its security rests on public smart contracts, transparent protocol data, careful wallet interactions and clear information for participants.

Revision history on GitHub (opens in a new tab)
On this page (5)
  1. Official addresses
  2. Owner controls and upgrades
  3. Security model
  4. Report a vulnerability
  5. Verify it yourself

Official addresses

Open Cosmic Signature only from these websites, and check an address character by character before you connect a wallet or approve a transaction. Any other site or account that claims to be Cosmic Signature is not.

Websites

app.cosmicsignature.com
The app: gestures, allocations, anchoring and the public records
cosmicsignature.com
The project site: the art, the white paper and the guides

Community

X
@CosmicSignature (opens in a new tab)Announcements
Discord
discord.gg/bGnPn96Qwt (opens in a new tab)Community chat and support

Core contracts on Arbitrum One

The published source code of each contract is an exact match on Sourcify (checked September 24, 2026), so the bytecode on-chain is the code you can read. The contracts page lists every address.

Cosmic Signature Protocol
0x6a714Ae7B5b6eA520F6BCA23d2E609C4Fd5863F2Arbiscan (opens in a new tab)Sourcify (opens in a new tab)
Implementation contract
0x50eB3d05d2C463949DE9238D419385594f7AdB97The current implementation behind the Cosmic Signature Protocol proxy contractArbiscan (opens in a new tab)Sourcify (opens in a new tab)
Cosmic Signature CST Token
0xAD91843e6A58Ba560F577E676986AFb1dba6FBA0Arbiscan (opens in a new tab)Sourcify (opens in a new tab)
Cosmic Signature NFT
0xbb84Be3500A63581d3F2d5AC3bdF8685AAedad25Arbiscan (opens in a new tab)Sourcify (opens in a new tab)
Random Walk NFT
0x895a6F444BE4ba9d124F61DF736605792B35D66bArbiscan (opens in a new tab)Sourcify (opens in a new tab)

Back to contents

Owner controls and upgrades

The Cosmic Signature Protocol contract has an owner: one account that can change some of its parameters and upgrade its code, within the limits below. Every change is recorded on-chain and listed under coordination changes.

Owner
0x14c82Ce4E5713E88C9462680E9c02BF4a3089871A single-key wallet (an externally owned account), not a multisig or a timelock.Arbiscan (opens in a new tab)
Between cycles
The owner can change protocol parameters, such as the time each gesture adds or the allocation-track percentages.
During a cycle
The core parameters are locked from the moment a cycle activates, before its first gesture, until that cycle finalizes.
At any time
The owner can postpone a cycle’s activation until its first gesture arrives, change the delay before the next cycle, and manage the peripheral contracts: the Public Goods Beneficiary, the NFT metadata links and the Allocations Wallet retrieval timeout.
Upgrades
The protocol runs behind a UUPS proxy, so its address never changes. The owner can point it at new code between cycles only; the code in use is the publicly verified V2 implementation listed above.
Cosmic Council
Ownership is planned to move to the Cosmic Council once the protocol is stable. From then on, parameters change only through Coordination Proposals that clear the Coordination Quorum.

Back to contents

Security model

Arbitrum smart contracts record every protocol action. Before you connect a wallet or make a gesture, review the published contract addresses, the source code, the audit and the risks.

  • Open the app only from the official addresses above, and check the address bar before you connect a wallet.
  • Confirm a contract address on the contracts page before you interact with it on-chain.
  • Read every wallet prompt before you approve it: blockchain transactions cannot be reversed.
  • Cosmic Signature will never ask for your seed phrase or private keys. Anyone who does is not Cosmic Signature.
  • Do not treat CST, NFTs, gestures or allocations as guaranteed financial outcomes; see the risk disclosures.

Back to contents

Report a vulnerability

If you find a vulnerability in the Cosmic Signature contracts, the app or this website, email support@cosmicsignature.com with “Security” in the subject. A useful report says:

  • What you found, and which contract, page or address it affects.
  • How to reproduce it, step by step.
  • What it would let someone do, and to whose funds.
  • How the team can reach you.

Scope

In scope
The contracts under Official addresses, app.cosmicsignature.com and cosmicsignature.com.
Not in scope
Services Cosmic Signature does not run, such as wallets, marketplaces, bridges and the Arbitrum network itself. Report those to their own teams.

Please give the team time to reply and fix the issue before you disclose it publicly, and do not test an exploit against the live contracts or another participant’s funds. The same contact is published in the site’s security.txt file.

Back to contents

Verify it yourself

The strongest security signal is agreement between what the app shows, the verified contracts, the source code and live Arbitrum data. Each of these can be checked without trusting this site.

Back to contents