Every way Vesper can be traced, attacked, or let you down, as far as we know, in one place, with what fixes each and when. Monero's developers did this on camera and it is the most trust-building thing any coin has done. This page is updated with every release. If you find something missing, that is the bounty.
| Weakness | Who can exploit it | Severity | What closes it |
|---|---|---|---|
| The sender's crowd is 48. A payment's input hides among 48 outputs, three times Monero's ring. Decoys are drawn from a measured spending pattern (the rule Monero's wallets use); an attacker who knows that pattern still names the real coin 2.1% of the time (fair for 48 is 2.1%), and if Vesper's users spend differently from Monero's the gap widens until it is re-measured on testnet-1. A crowd of 48 is still not a crowd of everyone. | A statistical analyst with the whole chain | medium | Phase 3 stage two: membership proof among all outputs (research). 64 was measured (1.8%, 82 ms per payment) and judged not worth the cost yet. |
| Network origin is partly hidden, not hidden. A payment travels node to node (a stem) before any node broadcasts it, so the first announcer is a relay. An attacker running a share of the nodes still names the sender's node about that share of the time: measured 7% at 5% of nodes, 11% at 10%, 23% at 20%, against 15%, 25% and 39% with plain broadcast. Nothing between nodes is encrypted, so someone watching the wire is not stopped, and linking many payments from one sender within one 10-minute epoch is not modelled. | A network observer running many nodes; an internet provider | medium | --proxy through Tor hides your address from peers (built in). Encryption between nodes is outside this code; the production node. |
| A dishonest node can hand your wallet decoys of its choosing, shrinking your ring to one real output plus outputs it controls or knows, and it sees when your wallet looks and what it sends. | The operator of a remote node you trust | medium | Run your own node. Documented, same as Monero. --proxy hides your address from such a node, not your activity. Future: decoy sanity checks in the wallet. |
| The node has never met strangers. Per-address limits, a one-hour ban for rule-breakers, a peer table that checks gossip before trusting it, connection timeouts, caps on bodies, answers and blocks: all built and tested in simulation and on one PC, none of it against the open internet. Peers talk plain HTTP with no authentication. | Anyone on the internet, once there is a public network | medium | The public testnet is the test; the production node. Until then: private networks, or your own node behind Tor. |
| In a small network the stem is slow and thin. A payment can take 30 to 75 seconds to be broadcast while it travels the stem, and with only a few nodes the relays are easy to name. | Nobody directly; it is a cost of phase 4 on small networks | low | Grows out of the problem as the network grows; the timers are tunable rules. |
| The ledger lives in memory, about 0.65 kB per output: fine for a test network's first months, not for years. | Anyone who runs a node, eventually | low | An on-disk ledger and headers-first sync (planned). |
| Unaudited implementation. The constructions are standard; our code implementing them has been reviewed only by its authors. Privacy bugs are silent. | Anyone who finds the bug first | high | Independent cryptographic audit before genesis; the bounty; your review. |
| Public by design: the fee (every wallet pays the same minimum for a payment's size), the number of inputs and outputs, the payment's size, which block it landed in, and the 48 candidates for each spend. Outputs of one payment are siblings because they sit in one payment. A payment carries no timestamp and lists its inputs in key-image order, so neither the clock nor the order fingerprints a wallet. | Anyone | by design | Stays. Uniform payment shape (always 2+ outputs in random order, same fee rule, same ring size) keeps the fingerprint small. |
| Mining reward amounts are public, and so is the development fund's income and spending. | Anyone | by design | Stays. Issuance must be checkable; the fund is a glass box on purpose. |
| A view key sees every incoming payment, forever, and the key images of outputs held at export, so its holder can see those spends. | Whoever you gave the view key to | by design | Stays. Hand it out accordingly. One wallet has as many addresses as you like, but one view key still sees them all; a payment proof (proof pay / proof receive) shows one payment and nothing else. |
| The person who paid you knows what they paid you, the one-time key, and the amount, forever. | Your counterparty | inherent | Stays on every coin. They cannot see your other outputs or balance. |
| Exchanges at the edges re-identify you. An exchange that knows your name on the way in and another on the way out can bracket a trail by timing and amounts at the doors. | Exchanges and whoever can compel them | medium | Not fixable by a protocol. Atomic swaps and non-custodial on-ramps reduce it; disclosure is your choice via view keys. |
| Graphics cards beat CPUs on the current proof of work (Argon2id); Bitcoin's chips cannot run it, but a GPU farm has an edge over laptops. | A well-funded miner | medium | RandomX, the likely production algorithm, before any public network. |
| Early hashrate concentration. In the first weeks one party, possibly the founder, may hold more than half the mining power; the chain is then as honest as that party. | Whoever has the most hardware | medium at launch | Disclosure of founder mining; recruiting miners through the testnet; a difficulty rule that recovers in about 40 minutes if miners leave. |
| After a miner exodus, blocks are slow for about 40 minutes while difficulty steps down (ASERT-style, 10-minute half-life, limited to a quarter per block). | Nobody directly; it is a liveness cost | low | Accepted trade-off; the alternative (faster drops) invites cheap-block floods. |
| Payments are large: about 4 kB binary, 9.5 kB as JSON, versus 250 bytes for Bitcoin. A ring of 48 costs space, so do range proofs, and the ledger never deletes. Blocks are capped at 4,000,000 bytes. | Anyone who runs a node: storage and bandwidth | low | Bulletproofs+ (smaller proofs), an on-disk ledger and headers-first sync (planned). |
| One address for everything, if you choose to. Reusing one address across contexts is safe on chain, but off chain it lets people who know it in one context recognise it in another. | People you have given your address to | low, and yours | Built: wallet new-address gives each payer their own address, all unlinkable, even when payers compare notes. The wallet also spends from one address at a time where it can. |
| Not post-quantum. A large quantum computer could forge coins and recover private view keys from published addresses, linking every past one-time key to its address. Sealed amounts would survive. | A quantum computer that does not yet exist | future | The same migration every curve-based coin faces; no plan yet, stated so nobody assumes one. |
| Your wallet file is the money. Lose it or its password and the coins are gone; leak it and they are someone else's. Malware on the machine while the wallet is open reads the keys. | Anyone who gets the file, or your machine | high, and yours | Encrypted by default (scrypt, 128 MiB). A 55-character recovery code, shown once, rebuilds the wallet on any computer: write it on paper. Hardware-wallet support planned. |
The bounty rules are on the Join page. This page is the only marketing a privacy coin should need: a list of its own flaws, kept honestly.