Testnet: tokens have no value, and the vulnerable contracts are our own test fixtures. Limits

Acme Lend — pull-request checks (antibody-immune-demo)

Acme Lend: our deliberately vulnerable fixtureOpenround 15light-client confirmed
Acme Lend is our deliberately vulnerable fixture: a fictional lending protocol whose planted bugs are textbook classes, labelled in its code. Nothing here is a finding in a real protocol, and wNEAR on testnet has no value.

Overview

The program as near-antibody stores it. Its manifest hash commits the anchor, the targets, the rules and the terms; once it is open, the deployment's owner can change nothing it depends on.
Project
acme.antibody.testnet · our fixture project
Description
Fictional lending protocol with planted bugs (DELIBERATELY VULNERABLE TEST FIXTURE).
as written in the committed manifest
Program key
bounty.antibody.testnet/12
Phase
Open round 15this round since
Created
2YwpK13D…
Opened
aXgWJyvD…
Terms sha256
3a9c40175b7ae46a…
Manifest sha256
367dbe3ee920dd32…The manifest, as uploaded
Sealing key
6ab4d5aec5d7515c…Proofs are sealed to it. It counts only once its activation run (run 94) is attested on NEAR: 3c8H1vnS…

Its record

At stake
0.161wNEAR available now
Verified attempts
7
Paid findings
4
First claim
14 minafter it opened
Claimed in the first hour
60%of the escrow
Open for
13.9 h
view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: the manifest hash shown here, as near-antibody stores it

antibody judge --program 12

The rules as code

Each rule is one bit of the program's invariants contract. After a proof's calls, at the anchor, the verifier runs its check(): a set bit is a broken rule, paid by its severity. The verifier never reads a report.
RuleSeverityPayoutBudget per roundSource
solvencybit 0an attested proof pauses

Lender claims are covered at the committed reference price.

Critical
0.1 wNEAR
0.4 wNEAR
AcmeInvariants, line 13
fees_to_treasurybit 1

Accrued fees plus the treasury balance never decrease.

High
0.03 wNEAR
0.4 wNEAR
AcmeInvariants, line 16
share_pricebit 2

The vault's share price never falls for the remaining holders.

Medium
0.01 wNEAR
0.4 wNEAR
AcmeInvariants, line 18
protected_balancesbit 3added by a round

The protected saver's acUSD never falls in a transaction the saver did not send.

Medium
0.01 wNEAR
0.4 wNEAR
AcmeInvariantsV2, line 75

The budget caps what one rule pays per round, so many entry points into one root cause cannot drain the escrow. A finding's key is the rule and the entry point that broke it (by default, the target and function): the first proof of each key is paid.

The targets (9) on Sepolia

The terms

Committed in the manifest with the rules, their text fixed by the terms sha256, and enforced by near-antibody: no person decides a payout.

Payouts

SeverityPayoutRules
Critical0.1 wNEARsolvency
High0.03 wNEARfees_to_treasury
Medium0.01 wNEARshare_price, protected_balances
Lownonenone
Bond per commit
0.001 wNEAR · refunded, or forfeited to this program's escrow when the proof breaks nothing
Instant payments
up to 0.1 wNEAR
When a payout is instant

Paid in seconds when the verdict is attested on NEAR, within 0.15 wNEAR per 1 h. Otherwise a payout waits the challenge window; above the cap it also needs an agreeing second run.

Challenge bond
0.005 wNEAR
Protocol fee
none · pinned at 0 for this program
Release fee
none · pinned at 0 for this program
Verification deposit
0.03 NEAR per run, paid by whoever asks for it; OutLayer refunds the unused part

The escrow against the largest payout

1.61×the largest payout
0.161 available / 0.1 wNEAR largest

The available escrow over the largest payout. Below 1× the status page raises an alert; a payout the escrow cannot cover is queued as debt, in commit order.

Pauses
An attested proof of solvency, on a light-client anchor, pauses the protocol on every chain the project registered (one pause ticket per round), with no minimum impact.
Known issues
At most 4, sealed before open, their base payouts at most 50% of the escrow.
Gap lane
A proof that breaks no rule but harms a declared protected account by more than $100 is refunded and recorded as a gap claim, with 0.01 wNEAR reserved. It is paid if a later round adds a rule its proof breaks.
Unevaluable
A proof the rules cannot evaluate (check() reverts or runs out of gas) is refunded.

The windows

WindowLengthWhat it bounds
Reveal
10 min
A commit is revealed within this, or it expires and its bond goes to the escrow.
Challenge window
60 s
A verdict that is not paid instantly is final after this; anyone may challenge it within it, with the challenge bond.
Resolve
5 min
A challenge with no attested result within this voids the verdict; both bonds are refunded.
Run timeout
4 min
A run that never answered is void after this.
Infrastructure grace
10 min
An infrastructure failure is retried this long, then the commit closes with a refund.
Round minimum
2 min
A round runs at least this long before the next one opens.
Re-run window
10 min
Re-runs at a proposed fix may be asked for within this of its confirmed check.
Disclosure delay
10 min
A paid proof becomes public at most this long after its claim.
Exit grace
60 s
After the deadline plus this, anyone may settle the program (exit).
Deadline
No commit is accepted after it.

The anchor

Every proof runs on the state proven at one block. A pause ticket, and the verdict guard, act only on an anchor the light client confirmed: on a project-attested anchor a verdict is about state the project chose.
Chain
Sepolia (11155111)
Block
12091630
Hash
0x7f44e2687a5f504e6fd193a30b16b1ab8b0dfeb90d0395b3324b81aa101c4f1c
Its check
confirmed by the light clientnear-antibody compared the hash with client-eth2.sepolia.testnet when the program was created.anchor_checked (LightClient): 2YwpK13D…
Base witness
The anchor state the rules and the round-0 checks read, proven against the anchor and pinned at activation.b6f631a2b78bc2f4…Uploaded in NEAR transaction 4XEcsY6Ju3… by acme.antibody.testnet

Check the hash yourself

view client-eth2.sepolia.testnet.block_hash_safe(12091630 as 8 little-endian bytes: 0xee80b80000000000)

Expected: byte 0 is 1 (the client holds the block), then 32 bytes equal to the anchor hash.

The same check from a terminal, and the one that also hashes the block header from a Sepolia RPC:

antibody judge --program 12
antibody anchor-check --block 12091630

Known issues

Declared sealed before open; a later proof with the same tag is not paid again. Their count, rules and severities are public; their content stays sealed for good.
1 sealed

Known issue 1

Mediumnot fixed: still breaks
Rules
share_price (slot 2)
Tags
24f13596550fd4e2…
Verified by
run 95 · CRfi6C5D…
Later proofs
commit 59 (our fixture agent E): matched the known issue, not paid

Declared before open (opened with 1 known: aXgWJyvD…). A round may never add one, and a known issue blocks no release.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: the first known issue's tag, as committed before open

antibody status --program 12

The chains

Per chain: the program's adapter, the proxies it may pause or upgrade, and every permit near-guardian asked the MPC network to sign, with the transaction that carried it there.

The sealed feed

Every commit in order: who, when, the state, the verdict and the payout; never the proof. A proof stays sealed until disclosure, and the project reads only the proofs it pays for.
Zero-knowledge proofs: none yet
CommitWhoWhenStateVerdictKeysPayout
Commit 55#0 · round 0
agent-a.antibody.testnetour fixture agent A
9DYyLTyN…
Paid
ViolationAttested on NEAR
solvency0dbd17cc…
0.1 wNEARCRani46z…
Commit 56#1 · round 0
agent-b.antibody.testnetour fixture agent B
FesPHtSz…
Paid
ViolationAttested on NEAR
fees_to_treasuryae1a0684…
0.03 wNEAREXqnfMSF…
Commit 57#2 · round 0
agent-c.antibody.testnetour fixture agent C
6u8TjVF6…
No violation · bond forfeited
No violationAttested on NEAR
no rule broken
—
Commit 58#3 · round 0
agent-d.antibody.testnetour fixture agent D
E3SGfugY…
Duplicate · confirmed at the fix
ViolationAttested on NEAR
solvency0dbd17cc…
—
Commit 59#4 · round 0
agent-e.antibody.testnetour fixture agent E
5UsSyZ1a…
Known issue
ViolationAttested on NEAR
share_price24f13596…
—
Commit 60#5 · round 0
agent-f.antibody.testnetour fixture agent F
9KvRqDuY…
Paid
ViolationAttested on NEAR
solvencyaa08b93a…
0.1 wNEARF3iq5cnY…
Commit 61#6 · round 0
agent-g.antibody.testnetour fixture agent G
5hMm5fc1…
Paid
No violationAttested on NEAR
no rule brokenpromoted in round 1: its re-run at that round's code broke a rule, so it is paid at its original priority
0.01 wNEAR8wgFtZVk…

A key is a rule and the entry point that broke it: the first proof of each key is paid; a later one is a duplicate that keeps its own proof record. Each commit's page shows its proof card and how to check it.

antibody status --program 12

Rounds and the release gate

A round ships a fix as code overrides at the same anchor. The enclave checks it, every paid proof is re-run against it, and a release permit is signed only for code that every paid proof fails against.

Round 1

release gate shut

In plain words

  • Fixed by this round's code (1 key, released from its holder)
    • solvency0dbd17cc… proven by commit 55 (our fixture agent A); duplicate commit 58 (our fixture agent D)
  • Still breaks (2 keys carried to the same holder)
    • fees_to_treasuryae1a0684… proven by commit 56 (our fixture agent B)
    • solvencyaa08b93a… proven by commit 60 (our fixture agent F)
  • Promoted: commit 61 (our fixture agent G): a duplicate or gap claim whose re-run broke a rule at this code, paid at its original priority
  • A paid proof still breaks a rule at this fix, so no release permit was asked for: this code does not ship.
Proposed
DZubAUwk… · the enclave checked the fix in run 104
Opened
HbU7B3w2…
Round manifest
28393292a9d77683…Uploaded in NEAR transaction 5fmFmweFtz… by acme.antibody.testnet
The fix proposed
AcmeLend to implementation0xAeDB1d8B…2EA4code hash 0x9aeaed18…

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 1's release gate is false

antibody status --program 12

Round 2

release gate holds

In plain words

  • Fixed by this round's code (2 keys, released from their holders)
    • fees_to_treasuryae1a0684… proven by commit 56 (our fixture agent B)
    • solvencyaa08b93a… proven by commit 60 (our fixture agent F)
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
CtkxDHHW… · the enclave checked the fix in run 110
Opened
5ih9iaBw…
Round manifest
ae2146f42a29692f…Uploaded in NEAR transaction 9dC7KT8WXQ… by acme.antibody.testnet
The fix proposed
AcmeLend to implementation0x5368c813…5dA2code hash 0xe4df125a…AcmeVault to implementation0xB0d41397…E0EFcode hash 0x41e54f80…

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 2's release gate is true

antibody status --program 12

Round 3

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
7Evyut92… · the enclave checked the fix in run 115
Opened
7XH3r2bv…
Round manifest
3d7ea268f775e2ee…Uploaded in NEAR transaction 26sVirkFrR… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 3's release gate is true

antibody status --program 12

Round 4

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
F4gr4Gc7… · the enclave checked the fix in run 121
Opened
GZxPYMEn…
Round manifest
6080eea9f952a934…Uploaded in NEAR transaction H7AHMp9JkQ… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 4's release gate is false

antibody status --program 12

Round 5

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
6Bp9jT42… · the enclave checked the fix in run 126
Opened
Ezp1YNHe…
Round manifest
1499498c22bd705e…Uploaded in NEAR transaction Ctpchh6J5w… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 5's release gate is false

antibody status --program 12

Round 6

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
4CfhBu9s… · the enclave checked the fix in run 131
Opened
Fbt82ADf…
Round manifest
8daf169481f78f34…Uploaded in NEAR transaction 4Nywt1ziBE… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 6's release gate is false

antibody status --program 12

Round 7

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
G1cdVURV… · the enclave checked the fix in run 136
Opened
HQk8jEqb…
Round manifest
ea889bec26b2daca…Uploaded in NEAR transaction 68UNsFAw8q… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 7's release gate is true

antibody status --program 12

Round 8

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
8NPmUdh4… · the enclave checked the fix in run 145
Opened
BdEwC86r…
Round manifest
9ee832c9524a03f9…Uploaded in NEAR transaction 2uTq7FgMZm… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 8's release gate is false

antibody status --program 12

Round 9

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
5sVcYqaH… · the enclave checked the fix in run 151
Opened
9uGGN1Up…
Round manifest
f4e2371ef5c61d4a…Uploaded in NEAR transaction 6XbCkdp5gg… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 9's release gate is true

antibody status --program 12

Round 10

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
84chs7np… · the enclave checked the fix in run 162
Opened
4KUxbgMm…
Round manifest
55c81df13211036b…Uploaded in NEAR transaction DjXFqzStaz… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 10's release gate is true

antibody status --program 12

Round 11

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
i2uMDFq4… · the enclave checked the fix in run 167
Opened
3zMs48mL…
Round manifest
8daa2c275fe7f981…Uploaded in NEAR transaction 8vTzvpmDDV… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 11's release gate is false

antibody status --program 12

Round 12

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
5ffLzHtB… · the enclave checked the fix in run 187
Opened
E7M7j64p…
Round manifest
9df4d84dd80d77e6…Uploaded in NEAR transaction GkKsnr5gLn… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 12's release gate is false

antibody status --program 12

Round 13

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
7cseA6jV… · the enclave checked the fix in run 198
Opened
YZ1hrCP3…
Round manifest
d5f1049194f299af…Uploaded in NEAR transaction 5iszBJyn1o… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 13's release gate is true

antibody status --program 12

Round 14

release gate holds

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • Every paid proof was re-run at this fix and fails: near-antibody asked for a release permit per proxy and chain.
Proposed
Cczk24wb… · the enclave checked the fix in run 210
Opened
AWCRkp5B…
Round manifest
ae5a0da3ea17e9e1…Uploaded in NEAR transaction 363kB3w7qp… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 14's release gate is true

antibody status --program 12

Round 15

release gate shut

In plain words

  • Fixed by this round's codenone
  • Still breaksnothing: every paid proof fails at this code
  • Promoted: none
  • A condition of the gate failed, so no release permit was asked for: this code does not ship.
Proposed
1yLt3bbJ… · the enclave checked the fix in run 215
Opened
Bnegcun2…
Round manifest
283366efa6aa0eb6…Uploaded in NEAR transaction dmGh3recoZ… by acme.antibody.testnet
The fix proposed
No release named.

Re-runs at this fix

Release permits

None: the gate stayed shut.

view bounty.antibody.testnet.get_program({"program_id":12})

Holds if: round 15's release gate is false

antibody status --program 12

Each re-run is an enclave run with its own page: its verdict and its attestation. How rounds work: docs/rounds.md .

The ledger

Every movement of the escrow keeps funded equal to available + reserved + paid + fees + returned. Amounts in wNEAR, which has no value on testnet.
balances

Where the escrow is

Available0.161
Reserved0.000
Paid0.240
Fees0.000
Returned0.000
Funded0.401

What came in

Deposits0.400
Forfeited bonds0.001
Challenge bonds0.000
Funded0.401

Forfeited bonds go to this program's escrow, where they pay future findings: never to us. Here, 0.001 wNEAR came in that way.

The audit

Accounted
0.401
Reservations
0 · held by the commits; equals reserved when it balances
Debt
0 · owed and not yet funded, queued in commit order
Defaulted
0
view bounty.antibody.testnet.audit({"program_id":12})

Holds if: ok: true (funded equals accounted, and reserved equals the commits' reservations)

antibody view --contract bounty.antibody.testnet --method audit --args '{"program_id":12}'