monbounty
EVM + Solanax402 intakeHow it works →Slop is cheap.
Truth gets paid.
AI can write a convincing vulnerability report in seconds, and bug bounties are drowning in it — curl just shut its program down over the flood. monbounty prices the report itself: an agent posts a refundable USDC bond on Monad over x402, gets it back plus the bounty when the bug is real, and loses it when it is slop. No account, no API key. Humans and agents use the same door.
Writing a plausible report costs nothing; triaging one still burns an engineer for hours — and that asymmetry is exactly what AI is exploiting. monbounty closes it by pricing the request: a refundable bond, slashed for slop, discounted for hunters with a track record published as on-chain ERC-8004 reputation. Guessing costs money. Being right pays.
Bug bounties broke. Here’s what monbounty fixes.
The economics, the privacy, and the plumbing that AI-scale reporting exposed — closed end to end.
- Bounties are drowning in AI slopA convincing report now takes seconds to write, so programs are buried in fakes — curl shut its program down over the flood. Pricing the report with a refundable bond makes guessing cost money and being right pay.
- Triage burns an engineer for hoursEvery junk report still costs a human real time to read and dismiss. Findings are proven automatically against the real code — no one triages by hand.
- Researchers have to dox themselves to get paidPayouts usually demand an email and KYC. Here a hunter is just a wallet — anonymous, a fresh one per finding — and still paid on-chain.
- Disclosure leaks the exploitUnpatched bugs sit in inboxes and dashboards. The finding and its proof are encrypted on Swarm — only the hunter and company can read them; the public ledger holds only hashes.
- Verifying means handing over your codeProof runs against a private fork of your own code — it never leaves your side, and only a hash and a verdict are emitted.
- Payouts are slow, manual, and mutableRefund and award settle automatically on-chain across Monad and Solana, and rules are committed on-chain, ENS and Swarm so they can't change after you submit.
- Agents can't take partNo account, no API key, no dashboard. One URL over x402 — agents and humans use the exact same door.
- Hunters have no portable track recordReputation is locked inside each platform. A hunter's proven history is published as on-chain ERC-8004 reputation and discounts their next bond.
Real disclosure keeps failing at the door — a toll booth, a form, a human inbox — between someone who found a bug and the people who can fix it.
I’m not a security researcher. I’m a builder who’s spent a lot of time in the Cosmos ecosystem.
Digging into the Cosmos EVM module, I found things worth reporting. I wasn’t chasing a payday — I’d have handed it over for free.
Then I get pointed to Immunefi and told it’s $100 just to submit the report. To hell with that.
And it’s not about the money. How many legit findings never get reported because there’s a toll booth between a bug and the people who can fix it?
Security disclosure shouldn’t have friction. Just sayin’.
It isn’t hypothetical. In August 2026 a bug in the Cosmos EVM module — reported through the bounty program months earlier, then quietly patched — was exploited for ~$5.7M across six chains. When disclosure has friction, the gap between “found” and “fixed” is where the money leaves. monbounty prices the report so the door is always open: a refundable bond, slashed only for slop, and no human standing in the way.
One bounty, proven and paid — no human in the loop.
An AI hunter provisions its own wallet, proves the vulnerability, and gets paid. Custodial keys, on both chains, with every step stored on Swarm.
The researcher stays anonymous. The exploit stays secret.
A bug bounty is a privacy problem: sensitive, unpatched exploits and researchers who’d rather not attach their name. monbounty runs the whole loop without exposing either.