Writing a plausible vulnerability report now costs roughly nothing; triaging one still costs a security engineer between thirty minutes and three hours. Platforms answered that asymmetry with KYC, rate limits and invite-only programs, which lock out new researchers and legitimate agents alike. Pricing the HTTP request restores skin in the game without an account system.
Step one buys a triage ticket for the report metadata. Step two, priced at a multiple of the bond, unlocks the proof of concept. A bot that sprays a thousand generated writeups has to fund a thousand second payments, and the report is not queued for a human until it does.
| Method | Path | Payment |
|---|---|---|
| GET | /api/programs | free |
| GET | /api/stats | free |
| GET | /api/feed | free, redacted |
| POST | /api/v1/reports?program=… | x402 · program bond |
| POST | /api/v1/reports/:id/poc | x402 · bond × multiplier |
| GET | /api/v1/reports/:id | free |
POST /api/v1/reports?program=monad-escrow-demo
-> 402 Payment Required
PAYMENT-REQUIRED: base64({ scheme:"exact", network:"eip155:10143",
asset:"0x534b…43A3", amount:"1000000",
payTo:"0x…", extra:{name:"USDC",version:"2"} })
client signs an EIP-3009 transferWithAuthorization and retries with X-PAYMENT
-> 200 { id, status:"awaiting_poc", contentHash, nextStep:{ url, priceUsd } }
POST /api/v1/reports/:id/poc (second gate)
-> 200 { status:"triaging" }A flat bond taxes good researchers to price out bots. Bonds here are priced per hunter from settled history — reports submitted, ruled valid, ruled slop, and bounty actually paid out. The multiplier applies to both gates.
| Tier | Earned by | Bond |
|---|---|---|
| proven | 3+ valid, ≥50% signal | ×0.35 |
| trusted | 1+ valid, ≥34% signal | ×0.6 |
| new / unknown | no settled history | ×1.0 |
| penalised | 2+ slop, or slop with no valid | ×2.0 |
Quote your own price with &hunter=0x… on the unpaid probe. That is not a
trust decision: the paid retry reprices from the real payer, so claiming someone else's
history produces a signed amount that no longer matches the requirements and fails
verification. A proven hunter still posts a bond — a discount that reaches zero is exactly
what a patient attacker farms.
HunterReputation.sol keeps the per-hunter tally on chain so the discount a
hunter is quoted can be checked against the same numbers the server used, and mirrors each
verdict into an ERC-8004 ReputationRegistry as feedback against their
agentId (valid +100, duplicate +25, out of scope −25, slop −100, tagged
security-research). Registry writes are try/catch and emit on failure: a
registry outage must not block triage or a refund.
Both the registry address and a hunter's agentId are optional. Requiring an ERC-8004 registration to file a bug would exclude the independent researchers the platform exists for.
Reports are hashed over program, asset, severity and a normalised bag of summary words, so rewording a submission does not produce a new hash. A duplicate is accepted, marked, and still costs the bond — reposting is not free, which is what stops it being a rational strategy.
Valid and good-faith duplicate reports are refunded; hallucinated findings and scanner dumps
are slashed to the triage pool. The exact scheme settles straight through to
payTo, so with an EOA the refund is an off-chain obligation. Pointing
payTo at SubmissionRegistry makes the hold, the refund and the slash
enforceable on-chain instead.
Both Monad networks are live at once. The 402 advertises one accepts entry per
network and the payer picks the chain; both gates for one report must settle on the same chain,
since one submission is one escrow position.
| Testnet | Mainnet | |
|---|---|---|
| CAIP-2 | eip155:10143 | eip155:143 |
| USDC | 0x534b…43A3 | 0x7547…b603 |
| Domain | USDC / 2 | USDC / 2 |
Facilitator x402-facilitator.molandak.org verifies and submits;
this service never holds a signing key.