Bug Hunt report ① | August 26, 2026

[ignotusnemo]

The first Bug Hunt payout is complete.

@AGI-is-going-to-arrive submitted eight confirmed reports against the mainnet release: one critical and seven non-critical. The critical finding did not break consensus, proof validity or cryptography. It concerned browser-originated access to the local wallet RPC.

The reports led to these fixes in v1.0.2:

• browser-originated requests can no longer reach the local wallet RPC;
• empty wallet recipients are rejected;
• the external miner stops before its template expires;
• development payouts reserve their required proof position;
• a full HeaderDAG evicts losing leaves instead of stalling synchronization;
• interrupted suffix synchronization preserves its durable authority;
• ASERT and MTP validation load missing headers from canonical storage or fail closed;
• obviously weak Photo Key inputs are rejected.

These fixes do not change consensus rules, the wire protocol, proof profile, matrices, ports or storage format.

Reward paid to @AGI-is-going-to-arrive: 13,500 NOID

• 10,000 NOID for the critical report
• 3,500 NOID for seven non-critical reports

Thanks also to @lucasan123, who independently reproduced the browser-origin issue using the official Windows binary. His report arrived eight hours after the first report, so it was treated as a duplicate under the Bug Hunt rules and did not receive a separate reward.

The payment receipt is included below so the payment remains independently verifiable after the block body is pruned.

13,500 NOID payment receipt

024a01000000000000a30100c30a95efa76606a645c454436d77b90ee7226c2166bcf11b47d40216e242eca010270000000000001c5b237454adabeb0e9537b58702d7fe8c0e6330c30b58ee9b3f198a3b46f6789394940000ecba83020000007214000000000000c6cb940000ecba8302000000c62e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c23f940000a7a9240300000070fae5b3c04873e870a9acb147d21aee403ae1592f2e258803b841fba58f4adfc33f9400f009cce2010000001c5b237454adabeb0e9537b58702d7fe8c0e6330c30b58ee9b3f198a3b46f678030f000000000001000200dbbb7092daedaa2d5361e1f6a35a4786a749c01cc442e53ae29f2fdc9251646c234fbf0c2ee1b07d9d8e12b9bac1f43f5f390a70e1268530d909211fcb9a45ce36c667f10c6b2b36f530c880abd1fe4901d524938d158143b25bcc33bd07b412ecc5ae6dfe693c5fab1bf1424eb76ad902df5bf25a4d0ad873e0042411bb8f1a7fc55a9e486a8c44d8af1bb892747dcb1b1a5835a6689a7e52e31a28e76ce8e89a97fbf9a2e2b6bffaac7a4edf0f93d129e96091c471e006c3b95589ca49056773f7634dce1b7d25764bc85abb09f7214212bb7109f32082063c1372f6ceb16448467106d14b83397b58f56b70d8608da2d0f2a7e8069008f32ee76ee4a409442db974dad0ac480174784a7c0df23b37de2ef8bb1fa63c569c997c44971d231bad4c000000000000215da4dd572c55b2bc48b9946924cee530572d1115c4f048bc6daaf9065dac540200000000000000939494001c5b237454adabeb0e9537b58702d7fe8c0e6330c30b58ee9b3f198a3b46f678c6cb94001c5b237454adabeb0e9537b58702d7fe8c0e6330c30b58ee9b3f198a3b46f6780200000000000000c23f940000a7a9240300000070fae5b3c04873e870a9acb147d21aee403ae1592f2e258803b841fba58f4adfc33f9400f009cce2010000001c5b237454adabeb0e9537b58702d7fe8c0e6330c30b58ee9b3f198a3b46f6781027000000000000ad4c00000000000026e68e6a00000000

The Bug Hunt remains open. The target is the current unmodified mainnet release. Same rules, same rewards.

Submit a private report