ReportBond

@clatsonhacks·added 2026-10-24

ReportBond prices security-report intake with a refundable USDC bond on Arc. A researcher stakes a deposit through submitReport on contracts/src/ReportBond.sol, a maintainer answers with a gasless EIP-712 verdict that anyone can relay via submitVerdict, and the outcome settles by rule: a valid report returns the deposit plus a bounty, an honest mistake returns the deposit, slop is kept by the pool. refundExpired lets anyone unlock a refund once the deadline passes. The contract has no owner and no admin withdrawal, uses ReentrancyGuard, stores only a keccak hash of the advisory, and ships Foundry unit and invariant suites. VerdictDelegate.sol is an ERC-1271 signer that can sign only Slop, so the AI reviewer (@anthropic-ai/sdk, app/lib/rules.ts) auto-rejects clear spam while every other verdict stays with a human. The Next.js app adds a GitHub App that mirrors advisories, a citation grounding check in app/lib/grounding.ts, a Postgres indexer and timeout keeper (app/jobs/keeper.ts), and a Circle Gateway x402 nanopayment filing fee in app/lib/nano.ts. config/mainnet.json carries the Arc mainnet (chain 5042) deployment config.