A blockchain-based alternative to the CVE (Common Vulnerabilities and Exposures) catalog that operates in a decentralized manner on the Polygon network.
Decentralized Vulnerability Registry (DVR) aims to provide the cybersecurity community with a censorship-resistant, transparent, and community-driven platform for sharing and validating security vulnerabilities. Unlike traditional centralized vulnerability databases, DVR cannot be shut down and is not controlled by any single entity, making it a truly open resource for security professionals worldwide.
- Decentralized Architecture: Built on Polygon blockchain for low fees and high throughput
- Community Validation: Vulnerabilities are validated by multiple security professionals
- Transparent Process: All submissions and validations are visible on the blockchain
- Censorship Resistant: No central authority can remove or modify vulnerability data
- Web3 Interface: Easy-to-use interface for submitting and accessing vulnerability data
- Understanding the Basics
- Setting Up Your Wallet
- Getting Test Cryptocurrency
- Setting Up the Project
- Deploying the Smart Contract
- Configuring the Frontend
- Launching the Application
- Using the Application
- Troubleshooting
- Frequently Asked Questions
- Additional Resources
- Glossary
- Contributing
- License
- Contact
The Decentralized Vulnerability Registry (DVR) is similar to the Common Vulnerabilities and Exposures (CVE) catalog but operates on a blockchain. This means:
- No single organization controls the database
- It cannot be shut down or censored
- The community validates and maintains the entries
- All information is transparent and tamper-proof
- Blockchain: We use Polygon (previously Matic), which is fast and has low transaction fees
- Smart Contract: Code that runs on the blockchain and stores vulnerability data
- Web Interface: How you'll interact with the smart contract
- Web3 Wallet: Software like MetaMask that connects you to the blockchain
- Go to MetaMask.io
- Click "Download" and choose your browser
- Follow the installation instructions
- Create a new wallet by clicking "Create a Wallet"
- Write down your recovery phrase (keep this very secure and private!)
- Create a password
đź“ť Note: Never share your recovery phrase with anyone! Anyone with this phrase can access your wallet.
- Open MetaMask by clicking on the extension icon
- Click on the network dropdown at the top (it probably says "Ethereum Mainnet")
- Click "Add Network"
- Click "Add a network manually" at the bottom
- Enter the following details:
- Network Name:
Polygon Mumbai - New RPC URL:
https://rpc-mumbai.maticvigil.com/ - Chain ID:
80001 - Currency Symbol:
MATIC - Block Explorer URL:
https://mumbai.polygonscan.com/
- Network Name:
- Click "Save"
You need some test MATIC tokens to pay for transactions. These aren't real money - they're just for testing.
- Go to Mumbai Faucet
- Connect with your GitHub account or Alchemy account (create one if needed)
- Copy your MetaMask address by clicking on your account name in MetaMask
- Paste your address in the faucet website
- Click "Send Me MATIC"
- Wait a few moments and check your MetaMask wallet to confirm you received the test MATIC
- Create a GitHub account if you don't have one
- Go to the DVR project repository (replace with actual URL when available)
- Click the green "Code" button
- Select "Open with Codespaces"
- Click "New codespace"
- Wait for the environment to load
- Go to Git Downloads
- Download the version for your operating system
- Install with default settings
- Go to Node.js Downloads
- Download the LTS (Long Term Support) version
- Install with default settings
- Open Command Prompt (Windows) or Terminal (Mac/Linux)
- Navigate to where you want to store the project:
cd Documents - Clone the repository:
git clone https://github.com/yourusername/decentralized-vulnerability-registry.git - Navigate into the project folder:
cd decentralized-vulnerability-registry - Install dependencies:
npm install
We'll use Remix, an online IDE, to deploy our smart contract.
- Go to Remix IDE
- You'll see a workspace with some example files
- In the "File Explorer" panel, click the "+" icon
- Name the file
DecentralizedVulnerabilityRegistry.sol - Copy the entire smart contract code from the
vulnerability-registry-contract.solfile in the project - Paste it into the new file in Remix
- Click on the "Solidity Compiler" tab (second icon on the left)
- Make sure the compiler version is set to
0.8.0or higher - Click "Compile DecentralizedVulnerabilityRegistry.sol"
- Wait for compilation to complete (you'll see a green checkmark)
- Click on the "Deploy & Run Transactions" tab (third icon on the left)
- In the "Environment" dropdown, select "Injected Provider - MetaMask"
- MetaMask will prompt you to connect - click "Connect"
- Make sure your account is selected in the "Account" dropdown
- Click "Deploy"
- MetaMask will open - review the transaction and click "Confirm"
- Wait for the transaction to be confirmed (this may take a minute)
- Once deployed, you'll see the contract under "Deployed Contracts"
- Important: Copy the contract address (click the copy icon next to the contract name) - you'll need this later
The ABI (Application Binary Interface) is like a translation guide for your application to communicate with the smart contract.
- In Remix, go to the "Solidity Compiler" tab again
- Click the "ABI" button to copy the ABI to clipboard
- In your project folder, create a new file named
contractABI.json - Paste the copied ABI into this file
- Save the file
- Open the
app.jsfile in your project - Find this line:
const CONTRACT_ADDRESS = "YOUR_DEPLOYED_CONTRACT_ADDRESS";
- Replace
YOUR_DEPLOYED_CONTRACT_ADDRESSwith the address you copied from Remix - Save the file
- In your command prompt or terminal, make sure you're in the project directory
- If you have Node.js installed, run:
npx http-server - If you don't have Node.js, you can use Python:
- On Windows (if Python is installed):
python -m http.server - On Mac/Linux:
python3 -m http.server
- On Windows (if Python is installed):
- Open your browser and go to
http://localhost:8080
- Push your project to GitHub (you can follow GitHub's guide for creating a repository)
- Go to your repository on GitHub
- Click on "Settings"
- Scroll down to "GitHub Pages"
- Under "Source", select "main" branch and "/root" folder
- Click "Save"
- Wait a few minutes, then visit
https://yourusername.github.io/decentralized-vulnerability-registry
- Open the application in your browser
- Click the "Connect Wallet" button
- MetaMask will open - click "Connect"
- Once connected, the button will change to "Connected"
- Fill out the submission form:
- Title: A clear, descriptive name for the vulnerability
- Description: Detailed explanation of the vulnerability, including how it works and potential impacts
- Affected Systems: Software, hardware, or systems affected by this vulnerability
- Severity Score: Rate from 1-10 (1 = minor, 10 = critical)
- References: Add related links in JSON format, e.g.,
["https://example.com/reference1", "https://example.com/reference2"]
- Click "Submit Vulnerability"
- MetaMask will open - confirm the transaction
- Wait for confirmation (may take 30-60 seconds on Polygon Mumbai)
- Once confirmed, your submission will appear in the vulnerability list
- Find the vulnerability you want to validate in the list, or enter its ID in the "Vulnerability ID" field
- Click "Get Details" to view the full information
- Review the details carefully
- If the information is accurate and complete, click "Validate"
- MetaMask will open - confirm the transaction
- Wait for confirmation
- The vulnerability's validation count will increase
- The main page displays recently submitted vulnerabilities
- Click "View Details" on any entry to see complete information
- Click "Refresh" to update the list with the latest submissions
- Make sure you're on the Polygon Mumbai network in MetaMask
- Try refreshing the page
- Check if your browser is blocking pop-ups
- Ensure MetaMask is unlocked (you've entered your password)
- Make sure you have enough test MATIC (at least 0.01 MATIC)
- Check if you're on the Polygon Mumbai network
- Try increasing the gas limit slightly in MetaMask advanced options
- Wait and try again - the network might be congested
- Click the "Refresh" button
- Check if your transaction was confirmed in MetaMask (under Activity)
- Verify your submission by searching for its ID in the validation section
- Make sure you're on the Polygon Mumbai network
- Check if you have enough test MATIC
- Try increasing the gas limit
- Make sure the contract compiles without errors
Q: Is this the same as the CVE database?
A: No, this is a decentralized alternative that uses blockchain technology to ensure no single entity controls the database.
Q: Do I need real money to use this?
A: For testing on Mumbai Testnet, you only need test MATIC, which has no real value. For a production deployment on Polygon Mainnet, you would need real MATIC.
Q: Can anyone submit vulnerabilities?
A: Yes, the system is open to all. However, submissions need community validation to be marked as verified.
Q: How is this different from a regular database?
A: Traditional databases can be altered or taken offline by their owners or by legal authorities. This decentralized version exists across many computers worldwide and cannot be censored or shut down.
Q: What happens if I lose my wallet?
A: If you have your recovery phrase, you can restore your wallet. If not, you cannot recover it. However, the vulnerabilities you submitted will remain in the registry.
Q: How do I move this to the main Polygon network?
A: You would follow the same deployment steps but connect to Polygon Mainnet instead of Mumbai Testnet in MetaMask.
Q: Can I modify a vulnerability after submission?
A: No, blockchain data is immutable. You would need to submit a new vulnerability with updated information.
Q: How many validations does a vulnerability need?
A: Currently, a vulnerability needs 3 validations to be marked as verified.
Q: Is my personal information stored on the blockchain?
A: Only your Ethereum address is stored. No other personal information is required or stored.
- Blockchain: A distributed digital ledger that records transactions across many computers
- Smart Contract: Self-executing code that runs on a blockchain
- Gas: Fee paid to process transactions on a blockchain
- MATIC: The native cryptocurrency of the Polygon network
- Testnet: A blockchain network used for testing, separate from the main network
- Mainnet: The main blockchain network where real transactions occur
- ABI: Application Binary Interface - how you communicate with the smart contract
- Web3: The next generation of the internet, built on blockchain technology
- Decentralized: Not controlled by any single entity or organization
- Wallet: Software that gives you access to your blockchain assets and identity
- Faucet: A service that provides free test cryptocurrency
- Transaction: Any action that changes the state of the blockchain
- Node: A computer that participates in a blockchain network
- Consensus: The process by which blockchain transactions are verified
We welcome contributions from the security community! Please follow these steps to contribute:
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add some amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
- IPFS integration for more detailed vulnerability information
- Enhanced search and filtering capabilities
- Integration with security tools via API
- Cross-referencing with traditional CVE database
- Mobile application development
This project is licensed under the MIT License - see the LICENSE file for details.
Disclaimer: This project is not affiliated with or endorsed by the CVE Program or MITRE Corporation.