v2.1.0 — Multi-Chain, Admin Panel, Security Hardening

What's New

Multi-Chain Support

• 5 chains: EVM, Solana, Bitcoin, Tron, Cosmos with wallet address auto-detection
• Chain auto-switch: dropdown follows detected address as you type
• Cross-chain detection: flags payouts where recipient chain differs from treasury (EVM), tracks bridge status
• Block explorer links: clickable tx/address links to Etherscan, Solscan, Mempool.space, Tronscan, Mintscan
• Per-chain treasury display: each signed payout shows the matching treasury address

Admin Review Panel

• Inline approve/reject directly from the dashboard (no curl needed)
• Adjustable payout amount before approving — admin can modify the suggested reward
• Inline rejection reason input (no browser popups)
• Admin toggle button with token entry
• Demo admin token: admin

Security Hardening

• Atomic daily budget check via SQLite transactions (race condition fix)
• SSE per-IP connection limits + dead connection cleanup via heartbeat
• SSE auto-reconnect with exponential backoff (frontend)
• CSP hardened: removed unsafe-inline, added HSTS, Permissions-Policy
• Admin rate limiting (20 req/min)
• Status filter validation (rejects arbitrary strings)
• Signing retry endpoint with audit trail
• Tron/Solana detection order fix (Tron checked before Solana catch-all)
• Bridge fields in all transaction paths (review + retry-sign)

Dashboard Improvements

• Click-to-expand report details with audit trail timeline
• Character counter on description field (0/5000)
• Toast notifications on submit success/failure
• 18 randomized demo reports including Solana/Tron wallets
• Reset button sends admin token correctly
• Demo buttons trigger chain auto-detection
• Title input maxlength enforced (200 chars)
• Focus-visible outlines, reduced-motion support, mobile breakpoints

New Endpoints

• GET /api/health — health check (pings database)
• POST /api/report/:id/retry-sign — retry signing for approved reports (admin)
• GET /api/reports/export — CSV export (admin)

Bug Fixes

• Reset button silently failing (missing auth header)
• Demo fill not triggering chain detection
• Bridge fields missing in manual review and retry-sign transactions
• Wallet API only showing EVM (now shows all chains)
• Tron addresses misdetected as Solana

Stats

• 24 integration tests
• 18 API endpoints
• 5 supported chains
• 30+ commits since v2.0.0

Contributors

• @dieutx
• @binhnt92
• @LoveMath95

v2.0.0 — Production-Ready MVP

BountyBot v2.0.0

First release. Automated bug bounty triage and payout authorization agent powered by the Open Wallet Standard (OWS).

Live demo: https://owsbountybot.shelmail.xyz

Core Features

• Evaluator — Quality scoring (0–10) with confidence, vuln class extraction, affected asset detection, manual review path
• Duplicate detection — Layered fingerprinting (title, description, vuln type, asset, combined) + fuzzy title matching with trigram similarity
• Policy engine — Per-severity caps, daily budget, per-reporter limits, chain allowlists, cooldowns
• Multi-step review — Auto-approve (low value), manual review (medium), admin review (high)
• Payout authorization — OWS-signed approvals with nonce, expiry, and transaction lifecycle states
• Audit logging — Append-only log with correlation IDs, filterable by entity type/id
• SQLite persistence — WAL mode, 7 tables with proper schema and indexes

Security

• Admin token required for manual review, reset, and program re-creation
• CORS, CSP, rate limiting (5/min per IP), SSE connection cap (200)
• Constant-time token comparison, signature redaction from all API responses
• Input validation via Zod, wallet address format validation per chain
• Policy re-check before signing on manual approval
• COALESCE-safe SQL to prevent NULL data loss

Dashboard

• Real-time SSE feed with status filters (All / Signed / Pending / Rejected / Duplicates)
• Silent smart-diff background sync (only updates changed items)
• 16 randomized demo reports across 3 quality tiers
• One-click reset, live connection indicator
• Confidence scores, vuln class tags, duplicate flags

API Endpoints

Endpoint	Method	Description
/api/bounty/create	POST	Initialize bounty program
/api/bounty	GET	Program stats
/api/report/submit	POST	Submit a bug report
/api/report/:id	GET	Report detail + audit trail
/api/report/:id/review	POST	Manual approve/reject (admin)
/api/reports	GET	List with ?status= and ?duplicates=1 filters
/api/reset	POST	Clear all data (admin)
/api/wallet	GET	Treasury wallet address
/api/transactions	GET	Payout history
/api/policy	GET	Active policy + daily budget
/api/audit	GET	Audit log with filters
/api/events	GET	SSE real-time stream

Tech Stack

• Node.js 24+ / Express 5 / ESM
• SQLite (better-sqlite3, WAL mode)
• Zod validation
• @open-wallet-standard/core (OWS SDK)
• Vanilla HTML/CSS/JS frontend (no build step)
• 18 integration tests

Contributors

• @dieutx
• @LoveMath95
• @binhnt92

Built for the OWS Hackathon 2026 — Track 2: Agent Spend Governance & Identity.