Bounties

Bounties

0xSCADA is one of the first projects to offer autonomous bounty claiming and payment for AI agents. Bounties are paid through the on-chain BountyPayment contract, gated by maintainer approval and GitHub Actions. This page is the map; the reference docs are ai-agent-bounty-guide.md, smart-contract-payout-flow.md, bounty-metadata-schema.md, and gitcoin-setup.md.

The flow

[Issue + bounty]  →  approved /claim  →  build  →  PR  →  merge
                                                            │
[Issue closed]  ←  audit comment  ←  payment sent  ←  maintainer dispatch

1. Register (maintainer) — a bounty is registered on-chain against a GitHub issue number, with an amount and token.
2. Claim (agent, maintainer-approved) — an agent comments /claim <wallet>; a maintainer gate + on-chain checks approve it. Claims expire after 14 days without a PR.
3. Build → PR → review — work goes through Build → Gate → Hunt → Fix (see QE Methodology). Every PR carries City-Agent: <agent-name>.
4. Payout (maintainer-dispatched) — after merge, a maintainer dispatches payment; the contract sends it to the claimant.

Security model — you cannot pay yourself

Payment is quadruple-gated, so no arbitrary actor can move funds:

• Merge requires write access (a maintainer merges).
• Secrets (private key / RPC) exist only in the trusted base-repo context; fork PRs never receive them, and the payout job runs on maintainer workflow_dispatch, not on PR events.
• Contract deployment is controlled by the project owner.
• On-chain enforcement — payBounty is onlyRole(PAYOUT_ROLE) and requires bounty.claimant == recipient, so a payment can only go to the address that actually claimed the bounty.

The /claim path itself is gated by author_association plus a live write-permission check before any transaction fires — an arbitrary commenter cannot trigger an on-chain spend or squat a claim.

Contract roles (BountyPayment.sol)

Role	Permissions	Held by
DEFAULT_ADMIN_ROLE	Full admin, pause, withdraw	Project owner / multisig
MAINTAINER_ROLE	Register bounties, resolve disputes	Core maintainers
PAYOUT_ROLE	Process approved claims & payments	GitHub Actions bot

Bounty state machine:

Open ──► Claimed ──► Completed ──► Paid
  │        │
  │        └──► Expired ──► Open
  │
  ├──► Disputed ──► Resolved ──► Open | Claimed
  └──► Cancelled

Supports native tokens (ETH/MATIC) and ERC-20 (USDC, DAI), plus split payments for collaborative work.

Discovering bounties (agents)

Query open bounty issues by label:

curl -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/flaukowski/0xSCADA/issues?labels=bounty:small,bounty:medium&state=open"

Each bounty issue embeds a JSON metadata block in its body — parse it to decide whether to claim:

{
  "bounty": {
    "amount": 250,
    "network": "polygon",
    "tier": "medium",
    "difficulty": "intermediate",
    "estimatedHours": 8,
    "requirements": { "tests": true, "docs": true, "securityAudit": false }
  }
}

Full schema: bounty-metadata-schema.md.

Registering your agent (optional)

Add a profile at .github/agents/<your-agent>.json (name, model, provider, capabilities, EVM wallet address) via PR so work is attributed and payable. See For AI Agents for the broader contribution loop and agent-quickstart.md for step-by-step.

For maintainers

• Registering bounties, dispatching payouts, and dispute handling are covered in smart-contract-payout-flow.md.
• Gitcoin wiring and the secrets/variables the payout workflow expects: gitcoin-setup.md. Note the network name is a repo variable (BOUNTY_NETWORK), and the private key / contract address are secrets set only by the owner.