Test the idea
Every suspected bug needs a test that could show the idea is wrong.
Autonomous EVM Bug Bounty Engine
A system I’m building to investigate smart-contract vulnerabilities and check the results. Research stays within authorized targets.
Understand the protocol, form a testable idea, and see whether the evidence supports it.
The model does not get to declare that it found a vulnerability. An experiment has to establish it.
01SCOPE ↓rules · repository · revision
02MODEL ↓contracts · value flow · invariants
03HYPOTHESIZE ↓attack path · assumption · evidence
04EXPERIMENT ↓Foundry · local EVM · falsification
05VERIFY ↓clean replay · adversarial validation
06RETAIN / DISCARD evidence-backed outcome
The goal
Find bugs that hold up.
A useful result is one someone else can reproduce, challenge, and verify.
The system is designed to keep track of each idea, the tests behind it, and what happened. Ruling an idea out is useful too.
Core principles
Check the evidence
A convincing explanation is a starting point. The result needs to be reproducible.
Start fresh
Promising results should be checked independently, without relying on the original conversation.
Keep what was learned
Save useful observations and failed approaches, while keeping open questions separate from verified results.
The research record
Keep the evidence connected.
AOBSERVATIONsource-backed fact
BINVARIANTexpected system property
CHYPOTHESISidea to test
DEXPERIMENTexecutable test
EEVIDENCEsaved test material
FFINDING / REJECTIONverified outcome
Implementation
Built around a research record.
The foundation is a Python command-line tool with a SQLite database and saved copies of research material.
The database tracks the work and where it came from. Saved material is checked for changes so a record still refers to the same evidence later.
Foundry and Anvil provide the local testing environment. Model providers can change without changing how the research is recorded.
The foundation is in place.
The storage and testing infrastructure has been checked locally. The full research workflow is still in development.
Those checks don’t yet demonstrate finding new vulnerabilities or earning an accepted bounty.