For the bench · NEAR Hackathon 2026 · Security track
Re-run the exploits offline, then prove the payouts from chain data — 5 of 5 real exploits paid on the demo bounty, 0 of 21 fakes paid on the corpus bounty. No NEAR account, no key. What still rests on trust (the worker's TDX quote, the archival RPC) is listed under Limits.
real Ethernaut exploits paid on the keyless demo bounty
SEALEDcorpus/results.jsonfakes paid: all 21 refused on chain, each with a reason
corpus/results.jsonrefusal kinds fired on chain, one tx hash each
corpus/refusals.jsonrequest → verdict, p50 of 29 runs (p95 10.85 s)
corpus/bench.jsonTwo-command path · do X → see Y
Two commands check the headline: one re-runs every published verdict on your machine, the other proves the demo payouts from chain data.
Re-runs every published commit under wasmtime from the verifier wasm its bounty pinned (sha256-checked): 29 OK · 0 FAIL, with validateInstance → 1 for a real exploit, 0 for a fake (the 4 malformed inputs stop before that call). Offline.
Reads chain data from a public archival RPC and proves the 5 of 5 paid demo-bounty runs: pinned hash, the operator's scoped worker key, verdict, delivery hash and PAID (about 1.5 min).
archival RPC · ~25 callsOn-chain receipts · every hash in corpus/results.json
The headline numbers above resolve to individual testnet transactions and the hashes each bounty was pinned to.
A real Ethernaut exploit, awarded at the verdict and paid on delivery once sha256(enc) matched — 1 000 tUSDC. Open the PAID deliver tx.
A near-miss that does not break the level is refused on chain and its bond slashed: REFUSED 2 no invariant broken. Open its commit tx.
Every bounty commits the verifier WASM by hash at funding; make replay checks the sha256 before it runs a byte, so you run exactly the bytes every request pinned. Chain data shows the operator's scoped worker key answered, not that the worker ran those bytes.
The demo and corpus bounties run from one NEAR global contract code hash with zero access keys — nobody can pull awarded escrow.
global hash 7HtmeswB…Honest by design
Testnet only. The mainnet leg is prepared (scripts/mainnet_leg.py) and has not run.README · Honest limits, item 1Worker attestation.README · Honest limits, item 2make verifyshows the request pinned the verifier hash and the operator's OutLayer worker key answered (a FunctionCall key limited to OutLayer's contract, its method list includingresolve_execution). It checks the key, not its TDX quote, and does not show the worker ran exactly those bytes.make replayre-runs the same bytes locally.
No outside users yet. The measured demo is our own hunter client (README · Honest limits, item 7scripts/hunter.py) committing the corpus' real exploits and fakes; the LLM hunter agent (scripts/hunter_agent.py) never submitted on chain: its exploits were checked against the local verifier only (hunter-agent/).