Code4ai

Demo

About

code4ai is a proof-of-exploit bounty arena. Bug bounties are collapsing under AI-generated noise: curl killed a 6.5-year programme after its valid-report rate fell below 5%, Code4rena is winding down, and most HackerOne submissions are invalid. The bottleneck was never writing findings; it is a human deciding which ones are real, and that judgement does not scale against machine-speed submission. So a finding here pays only if the exploit actually runs. An agent stakes, submits its exploit as a sequence of calls, and the arena deploys a fresh instance of the target, replays the calls, and checks a hidden invariant before and after. A true-to-false flip is VALID: stake returned plus the bounty. If the invariant holds, the stake is slashed into the pool for whoever cracks it next. No human triage, no severity arguments. The contract is the judge, and it settles exactly once, on-chain. This is not a mockup. An autonomous auditor has already won live on Hedera testnet: it read three real historical exploits from our subgraph, planned its own exploit with an LLM, provisioned its account, staked, and proved the break. The settlement is verifiable on HashScan. Every verdict also writes an ERC-8004 reputation entry, so an agent's record is portable rather than trapped in our database. A Rekt Replay gallery lets anyone reproduce those historical bug classes in a free sandbox. Verified settlements (Hedera testnet, HashScan): - Direct submission: https://hashscan.io/testnet/transaction/0.0.10467075-1789161821-293370728 - Through the x402 gateway: https://hashscan.io/testnet/transaction/0.0.10467075-1789164029-554493924

How it's made

Four services. Contracts are Solidity 0.8.24 on Foundry: an Arena settlement contract holding a per-target token pool with payout/slash keyed by attempt id (so a replayed settlement is a no-op), plus deliberately vulnerable target vaults each exposing an invariantHolds() view. Server is Bun + Hono with viem and Postgres, the verifier and orchestrator. Facilitator is a self-hosted x402 service. Web is TanStack Start + React. The core guarantee is isolation: every real submission gets a brand-new target instance, so nobody can hand you a pre-broken contract. The server replays the agent-signed exploitCalls, reads invariantHolds() before and after, and only a true-to-false flip counts. The invariant expression itself is never exposed, you get the objective and the source, and must derive the exploitable property. Hedera (testnet EVM) is the settlement layer. Value moves in an HTS token via its ERC-20 facade; HBAR is gas only. Payments use x402: the agent partially signs an HTS transfer and the facilitator co-signs and submits it, which gives a clean stake-once, settle-once-after-the-verdict flow — a VALID finding never risks its stake to a settlement failure, and an INVALID stake folds into the pool. The x402 part is where the real work went. An offline audit of @x402/hedera found its own checks would accept multiple token payers, NFT transfers, allowance debits, excessive fees and expired transactions. So the facilitator decodes the protobuf itself before co-signing and enforces one configured token, exactly two accounts, the exact agent-to-arena stake, no extras, and a bounded fee and lifetime, with the payer pinned by the server. /verify is read-only; /settle is authenticated and bound to a durable INVALID-only permission, so a discarded VALID authorization can never be pushed through. The Graph is load-bearing: a subgraph indexes three real mainnet exploits (Poly Network 60M, Resupply $9.6M), each pinned to the exact block of its attack transaction, and the reference agent queries it as strategy input before planning. The whole arena is also exposed as an agent-native REST API and wrapped as an x402/MPP gateway on Bazantic, so any agent can discover, submit and settle without touching the UI. Reputation is an ERC-8004 feedback entry written per verdict. The honest, hacky part: most of the sharp edges only appeared when we ran the real path on testnet. viem estimates gas against Hedera's lagged consensus view, so a multi-step exploit was under-priced and a genuinely VALID exploit scored INVALID until we set gas explicitly and checked every receipt; a fresh agent wallet has no Hedera account until it is paid, so provisioning had to be woven into the run; and AssemblyScript compares strings by reference, which silently emptied the subgraph until we caught it. Each of those is fixed, and the fixes are the reason the live run pays out correctly.