Post a bounty

Everything signs with your wallet. No NEAR wallet needed.

1. Set rules

Once posted, nobody can change them, not even you.

What does this bounty protect?Whitehats find it at /bounties/your-address/…

Covered contracts

Each needs a . Only contracts that can be covered, so no liquidations.

Chain

Contract address

Bounty amountUSDCPaid in full to the .

Smallest theft that countsUSDC don't win or pause anything.

End date

1 month3 months6 monthsCustom

Keep the exploit private fordaysYour time to fix the bug before it .

A bug you fix stops paying
A claim tests your contracts as they are at a recent block, so a bug you fix yourself stops being claimable 5 minutes after the fix lands.
The bounty is locked
It is locked until the end date and paid in full to the first proven theft of at least the minimum theft.
Fees stay spent
The posting fee isn't refunded and pause gas can't be recovered.
The worst case is a pause
The worst a wrong verdict can do is pause the covered contracts. BounTEE can never move your funds.
The exploit goes public
The winning exploit is published after the disclosure delay you choose.
Who you trust
OutLayer runs the judge in its enclave and returns the verdict. Intel makes the enclave's hardware and signs its attestation. NEAR's MPC network signs each pause and confirms it landed. The judge's pinned RPCs confirm the block a claim is judged against, three per chain. NEAR runs the bounty contract as written. Circle issues the USDC the bounty is held and paid in. BounTEE's builders hold no keys: after deployment they can't move funds, pause or change a bounty's rules. The README says what each could do if it misbehaved.