SEALED

Built for NEAR Hackathon 2026 · Security track

Your exploit stays sealed until the bounty owes you.

v0.1.0 · testnet · sealed-exploit.vercel.app

fresh clone · no NEAR credentials

$ make replay
REPLAY-OK d5-real-fallback: broken · wasm d2972cd2 · h_exploit 336ea1fb468c… = commit · verdict = chain · enc 508 B = h_enc
…
replay: 29 OK · 0 FAIL · verifier.wasm d2972cd2659c2ad4…
$

deliver AodmFQ6t… · PAID 2 1000000000

2 a.m. A working drain. Send it, and the team can patch it, call it “known” and pay nothing.

The white-hat's problem in a trust-first bounty

Owe first. Reveal on delivery.

Todaytrust-first bounty

hunterReveals the bug

triagerJudges it

protocolPays, patches or “known”

Sealedkeyless bounty

hunterCommits hash + bond

OutLayer TEERuns it: validateInstance

contractOwes, then PAID on delivery

One exploit, four hand-offs.

A real Fallback exploit on the keyless demo bounty. Press → to step through it.

8.51 scommit → verdict, block time

1.8 sdeliver → PAID, 1 000 tUSDC

Evidence

Exhibit A · real exploit

ethernaut / Fallback · invariant fallback-owner-drained · item real-fallback · demo bounty

Commit + bondt = 0H(exploit ‖ hunter ‖ salt) · FNbCUc53…
OutLayer TEE runs the sealed exploitrequest #6065pinned verifier d2972cd2… · revm on the committed snapshot
Worker verdict: broken+8.51 svalidateInstance → 1 · 2vdtrvQm…
Delivered to the protocol, hash-checkeddeliver +1.8 ssha256(enc) = h_enc · AodmFQ6t… · PAID 2 1000000000 = 1 000 tUSDC

Awarded at the verdict

Fakes meet intact tape.

Six refusal kinds, each fired on testnet with a reason in the log.

delivery mismatchREFUSED 0 delivery mismatch · FTdPqnJm…
invariant busyREFUSED: claim pending · 7yHvtQpE…
pool pullREFUSED: claim pending · EWPNBudg…
duplicateREFUSED: invariant already paid · 39JpmTh6…
expired awardEXPIRED 0; escrow 1000000000 back to pool, bond slashed · 3oaUKM3x…
fakeREFUSED 2 no invariant broken · DUtubHSc…

Evidence

Exhibit B · fake

ethernaut / Fallback · invariant fallback-owner-drained · item nearmiss-fallback-no-receive · corpus bounty

Commit + bondt = 0H(exploit ‖ hunter ‖ salt) · DUtubHSc…
OutLayer TEE runs the sealed exploitrequest #6070pinned verifier d2972cd2… · revm on the committed snapshot
Worker verdict: not broken+8.16 svalidateInstance → 0 · 6h8JbkoV…
Refused on chain, bond slashedREFUSED 2 no invariant broken · logged under the commit DUtubHSc…

Bond slashed · tape intact

How a bounty runs.

Receipts, not claims.

Each line names the command that reproduces it.

Property receipt

Exhibit 01 · NEAR testnet · data from commit f552bbb

Real exploits paid: 5 of 5make results
Fakes paid: 0 of 21make results
Refusal kinds on chain: 6 of 6make refusals
Runs re-checked from chain: 29make verify
Request → verdict: p50 7.27 s · p95 10.85 smake bench
Tests: 34make test

Reading a claim is not running it.

muse-wonder-1.0LLM · reads, cannot run

1 of 21

nemotron-3-ultraLLM · reads, cannot run

3 of 21

qwen3.8-omni-flashLLM · reads, cannot run

3 of 21

Sealed verifierOutLayer TEE · runs it

0 of 21

Each column is the same submission in every row. Third-party models, not NEAR AI Cloud, one run each; every fake a model paid is one of the 5 that carried a hunter claim; a reply with no verdict counts as not paying.

What is not proven yet.

Testnet only. The mainnet leg is prepared and has not run.
paraphrased from README · Honest limits, item 1
make verify shows the pinned verifier hash and a registered worker key, not the exact bytes the worker ran.
paraphrased from README · Honest limits, item 2
No outside users yet. Our own hunter agent plus the fakes corpus.
paraphrased from README · Honest limits, item 7

Next: the mainnet leg with native USDC, prepared in scripts/mainnet_leg.py

Run it before you judge it.

git clone https://github.com/edycutjong/sealedmake replay && make verify-demo

Nothing is opened before the money is owed.

sealed-exploit.vercel.app