← nonbond BUG BOUNTY · OPEN

Break the cloak, get paid.

NoN Bond pays for real vulnerabilities. If you can open a bond you should not be able to open, forge a receipt, or crack a transfer package, we want to know first, and we settle.

PAYOUT

Your pick, settled after the report is validated and the fix ships:

WETH on Robinhood Chain $n0n at spot

SEVERITY

CRITICAL

Opening any bond without its receipt. Forging a receipt that verifies. Recovering an asset, salt, or key from a commitment or a transfer package. Reward negotiated directly, top of the pool.

HIGH

Breaking transfer package encryption with a realistic attack. Making /verify return true for a receipt that should fail. Cross-site attacks that exfiltrate stored bonds.

MEDIUM

Bond storage corruption, cloak flow producing weak or reused salts and keys, anchoring flow sending anything other than what is displayed.

LOW

UI states that mislead about what is cloaked, revealed, or anchored. Broken flows on mainstream browsers.

SCOPE

The console at nonbond.trade/console: cloaking, proving, opening, transfer packages, import, anchoring
The verifier at nonbond.trade/verify
The commitment scheme as implemented: SHA-256 commitments, AES-GCM transfer packages, PBKDF2 key derivation
The engine contracts join the scope the day they deploy, and the bounty scales up with them

HOW TO REPORT

Write it up: what breaks, steps to reproduce, and a working proof of concept
Send it privately by DM to the project account on X. No public disclosure before the fix ships
First valid report of a given bug gets the payout. Include a wallet address for settlement
We confirm receipt, validate, fix, pay, and credit you in the changelog unless you prefer to stay cloaked

Report by DM on X

RULES

No testing against other users, no phishing, no social engineering, no denial of service
Test against your own browser storage and your own bonds only
Out of scope: the Pons launch contract, third party infrastructure, DNS, and anything requiring physical access
Good faith research under these rules will not be pursued

The protocol was built so nobody can watch you. If you find a way to watch anyway, that knowledge is worth money to us and to everyone cloaked. Bring it here first. Terms · Privacy