ProofOfHack

Demo

About

ProofOfHack bridges the gap between protocol teams needing verified evidence before paying bounties and security researchers needing payment certainty before disclosing findings. • Funded Bounty Escrows: Protocol teams create and fund immutable, fixed-reward USDC bounties locked in onchain escrow contracts. • Confidential Claim Submission: Researchers submit encrypted evidence packages that are hidden from the protocol team prior to payment. • Exclusive Claim Reservations: Submitting an active claim places a temporary, exclusive hold on the bounty reward so multiple submissions cannot fight over the same reserved funds. • Confidential Verification: An isolated verifier service evaluates the claim against the bounty policy and issues an onchain signed verdict without public disclosure. • Permissionless Payouts: Qualifying claims credit the researcher directly in the escrow. The researcher can collect USDC funds at any time without requiring protocol approval. • Post-Payment Report Delivery: The private vulnerability report is released to the protocol team's security reviewers only after payment finality is confirmed onchain. • DeFi Vault Coverage & AI Assistant: Indexes live ERC-4626 vault deployments via The Graph and uses a source-aware coverage assistant to recommend funding for uncovered vaults. • Bounded Funding Automation: Enables automated policy funding via Circle Agent Stack subject to strict onchain budget limits.

How it's made

1. Core Technologies Used • Frontend: React 19, Vite, TypeScript, viem for chain reads/encoding, and Lucide UI icons. • Backend & Database: Fastify, Node.js (>=22.14), PostgreSQL with Drizzle ORM, and pg-boss for durable PostgreSQL-backed background job queues. • Smart Contracts: Solidity 0.8.28, Foundry (forge), and OpenZeppelin ERC-20 / Merkle / ReentrancyGuard standards. • Cryptography: libsodium-wrappers-sumo and Web Crypto API for client-side envelope encryption and verifier signatures. 2. Partner Technologies & Sponsor Integrations -> Arc (Settlement & On-Chain Escrow) • Role: Arc testnet serves as the primary financial settlement layer. • How it helped: Arc's near-instant finality and native stablecoin architecture enabled atomic USDC bounty funding and payouts. • Benefit: Ensures low gas fees and deterministic transaction finality for automated report releases. -> Privy (Auth, Wallets & On-Chain Policy Controls) • Role: Powers identity for protocol teams and researchers, embedded wallets, and smart contract access rules. • How it helped: We integrated Privy’s policy engine to enforce programmatic treasury constraints (e.g., rejecting unauthorized funding actions or capping daily spending limits). • Benefit: Smooth Web3 onboarding without friction, paired with robust server-side wallet management. -> The Graph (Live Vault/Cont Coverage Indexing) • Role: Indexes ERC-4626 vault and general smart contract deployments across target EVM networks using custom GraphQL subgraphs. • How it helped: Queries real-time vault TVL, asset balances, and contract metadata to calculate which registered vaults/contracts lack funded bounty coverage. • Benefit: Gives protocols an automated, data-driven view of their security coverage gaps. -> Circle Agent Stack (Autonomous Bounded Funding) • Role: Powers an autonomous operations agent that monitors coverage gaps and top-ups bounties. • How it helped: Interacts with our BudgetController smart contract on Arc to execute programmatic bounty deposits within daily budget caps. • Benefit: Allows protocol treasuries to set rules once and let AI/agents handle routine security top-ups automatically. 3. How The Pieces Fit Together (Data & Control Flow) 1. Discovery & Recommendation: The Graph indexes vault data → Circle Agent or Coverage Assistant detects missing coverage → Recommends an approved policy. 2. Escrow Funding: Protocol owner approves transaction via Privy → USDC is deposited into the Arc Escrow Contract. 3. Encrypted Claim Upload: Researcher selects a bounty → Encrypts evidence payload in- browser using Sodium / WebCrypto → Ciphertext stored in object storage. 4. Isolated Verification: Verifier Service (running in an isolated container context with isolated keys) verifies the evidence payload against the target condition → Signs an on- chain verification proof. 5. Settlement & Report Release: Verifier proof is posted to Arc → Escrow pays USDC directly to researcher's Privy wallet → Report Release Service captures the PaymentFinalized block event on Arc → Unlocks decrypted report access to the protocol reviewer. Hacky & Notable Implementation Highlights 1. Cryptographic "Pay-Before-Reveal" Gate: The report-release service enforces a cryptographic barrier: the server refuses to serve the report decryption keys until it performs an independent RPC read verifying that the payout transaction has achieved block finality on Arc. 2. Isolated Verifier Sandbox vs. Trojanized Exploits: To solve the issue of trojanized PoCs (where malicious exploit scripts target protocol reviewers), we designed the verifier service as a headless, zero-trust runner. Proofs are evaluated in isolated memory without human reviewers ever touching raw executable code on local machines.