Acme Lend v1 — pre-launch (testnet)

Acme Lend: our deliberately vulnerable fixtureOpenround 0light-client confirmedearlier run

Acme Lend is our deliberately vulnerable fixture: a fictional lending protocol whose planted bugs are textbook classes, labelled in its code. Nothing here is a finding in a real protocol, and wNEAR on testnet has no value.

An earlier run on the same contracts, before the recorded one, kept on NEAR. The recorded run on the locked deployment (2026-11-04) is programs 5 (Acme Lend), 6 (practice) and 7 (fork mode).

Overview

The program as near-antibody stores it. Its manifest hash commits the anchor, the targets, the rules and the terms; once it is open, the deployment's owner can change nothing it depends on.

Project: acme.antibody.testnet, account: acme.antibody.testnet · our fixture project
Description: Fictional lending protocol with planted bugs (DELIBERATELY VULNERABLE TEST FIXTURE).
as written in the committed manifest
Program key: bounty.antibody.testnet/4, program key: bounty.antibody.testnet/4
Phase: Open round 0this round since 2026-11-03 16:02:37 UTC
Created: 2026-11-03 16:00:10 UTCEgfTZ8mL…, NEAR transaction: EgfTZ8mLntpfGfzHtrStxUtMMkVjji2YgDwKT4CZLMmW, opens an explorer in a new tab
Opened: 2026-11-03 16:02:37 UTCEdgXpczE…, NEAR transaction: EdgXpczE1qzKCqmES7nCchXCdqYTRwGjH9tR2BMcWUSy, opens an explorer in a new tab
Terms sha256: 3a9c40175b7ae46a…, terms sha256: 3a9c40175b7ae46a342566111ba65ca4a420c8ff2289eb7b08c8759b5125a34d
Manifest sha256: 7f6ccc5b783a0269…, manifest sha256: 7f6ccc5b783a0269f6c341e480a63ebddb65e2613052cd1b2b53d9b7366f7169Uploaded in NEAR transaction 7hCWPDLP3c…, NEAR transaction: 7hCWPDLP3cykczeraXZXNb7yHAtRVaWFH9uw5UysPnRk, opens an explorer in a new tab by acme.antibody.testnet
Sealing key: ed440042deec504f…, sealing public key: ed440042deec504fdc6412eefd4e09ea51ad98a5f1ff54a7fef7921e2c8d0c1cProofs are sealed to it. It counts only once its activation run (run 28) is attested on NEAR: Ao8kjEMS…, NEAR transaction: Ao8kjEMSxomRqLcthiPcovCdUdvTjw9eE7p4ma3XnuLV, opens an explorer in a new tab

Its record

At stake: 0.3wNEAR available now
Verified attempts: 1
Paid findings: 1
First claim: 281 safter it opened
Claimed in the first hour: 25%of the escrow
Open for: 145.1 h

view bounty.antibody.testnet.get_program({"program_id":4})

Holds if: the manifest hash shown here, as near-antibody stores it

antibody judge --program 4

The rules as code

Each rule is one bit of the program's invariants contract. After a proof's calls, at the anchor, the verifier runs its check(): a set bit is a broken rule, paid by its severity. The verifier never reads a report.

The program's rules
Rule	Severity	Payout	Budget per round	Source
solvencybit 0an attested proof pauses Lender claims are covered at the committed reference price.	Critical	0.1 wNEAR	0.4 wNEAR	AcmeInvariants, line 13 (the source of solvency, opens the repository)
fees_to_treasurybit 1 Accrued fees plus the treasury balance never decrease.	High	0.03 wNEAR	0.4 wNEAR	AcmeInvariants, line 16 (the source of fees_to_treasury, opens the repository)
share_pricebit 2 The vault's share price never falls for the remaining holders.	Medium	0.01 wNEAR	0.4 wNEAR	AcmeInvariants, line 18 (the source of share_price, opens the repository)

The budget caps what one rule pays per round, so many entry points into one root cause cannot drain the escrow. A finding's key is the rule and the entry point that broke it (by default, the target and function): the first proof of each key is paid.

The targets (9) on Sepolia

The terms

Committed in the manifest with the rules, their text fixed by the terms sha256, and enforced by near-antibody: no person decides a payout.

Payouts

The payout table
Severity	Payout	Rules
Critical	0.1 wNEAR	solvency
High	0.03 wNEAR	fees_to_treasury
Medium	0.01 wNEAR	share_price
Low	none	none

Bond per commit: 0.001 wNEAR · refunded, or forfeited to this program's escrow when the proof breaks nothing
Instant payments: up to 0.1 wNEAR
When a payout is instant
Paid in seconds when the verdict is attested on NEAR, within 0.15 wNEAR per 1 h. Otherwise a payout waits the challenge window; above the cap it also needs an agreeing second run.
Challenge bond: 0.005 wNEAR
Protocol fee: none · pinned at 0 for this program
Release fee: none · pinned at 0 for this program
Verification deposit: 0.03 NEAR per run, paid by whoever asks for it; OutLayer refunds the unused part

The escrow against the largest payout

3×the largest payout

0.3 available / 0.1 wNEAR largest

The available escrow over the largest payout. Below 1× the status page raises an alert; a payout the escrow cannot cover is queued as debt, in commit order.

Pauses: An attested proof of solvency, on a light-client anchor, pauses the protocol on every chain the project registered (one pause ticket per round), with no minimum impact.
Known issues: At most 4, sealed before open, their base payouts at most 50% of the escrow.
Gap lane: A proof that breaks no rule but harms a declared protected account by more than $100 is refunded and recorded as a gap claim, with 0.01 wNEAR reserved. It is paid if a later round adds a rule its proof breaks.
Unevaluable: A proof the rules cannot evaluate (check() reverts or runs out of gas) is refunded.

The windows

The program's windows
Window	Length	What it bounds
Reveal	10 min	A commit is revealed within this, or it expires and its bond goes to the escrow.
Challenge window	60 s	A verdict that is not paid instantly is final after this; anyone may challenge it within it, with the challenge bond.
Resolve	5 min	A challenge with no attested result within this voids the verdict; both bonds are refunded.
Run timeout	4 min	A run that never answered is void after this.
Infrastructure grace	10 min	An infrastructure failure is retried this long, then the commit closes with a refund.
Round minimum	2 min	A round runs at least this long before the next one opens.
Re-run window	10 min	Re-runs at a proposed fix may be asked for within this of its confirmed check.
Disclosure delay	10 min	A paid proof becomes public at most this long after its claim.
Exit grace	60 s	After the deadline plus this, anyone may settle the program (exit).
Deadline	2026-12-03 15:38:02 UTC	No commit is accepted after it.

The anchor

Every proof runs on the state proven at one block. A pause ticket, and the verdict guard, act only on an anchor the light client confirmed: on a project-attested anchor a verdict is about state the project chose.

Chain: Sepolia (11155111)
Block: 12056217 (opens an explorer)
Hash: 0xe9a6c3adef88372784cc7ee980ad910856c0cc7b54f70c3a1fa4895409a457fe
Its check: confirmed by the light clientnear-antibody compared the hash with client-eth2.sepolia.testnet when the program was created.anchor_checked (LightClient): EgfTZ8mL…, NEAR transaction: EgfTZ8mLntpfGfzHtrStxUtMMkVjji2YgDwKT4CZLMmW, opens an explorer in a new tab
Base witness: The anchor state the rules and the round-0 checks read, proven against the anchor and pinned at activation.e30ce3628ddfd2cd…, base witness sha256: e30ce3628ddfd2cd6d9c7c45f879d8cf080e4d4f75e9cc3fca2e1db04c0df6e5Uploaded in NEAR transaction 4dVsdC4UF1…, NEAR transaction: 4dVsdC4UF1u4gmUez3tSeHRb6eWgkkigWSVpoVZf8V7m, opens an explorer in a new tab by acme.antibody.testnet

Check the hash yourself

view client-eth2.sepolia.testnet.block_hash_safe(12056217 as 8 little-endian bytes: 0x99f6b70000000000)

Expected: byte 0 is 1 (the client holds the block), then 32 bytes equal to the anchor hash.

The same check from a terminal, and the one that also hashes the block header from a Sepolia RPC:

antibody judge --program 4

antibody anchor-check --block 12056217

Known issues

Declared sealed before open; a later proof with the same tag is not paid again. Their count, rules and severities are public; their content stays sealed for good.

1 sealed

Known issue 1

Mediumnot fixed: still breaks

Rules: share_price (slot 2)
Tags: 6078473139faa847…, known issue tag: 6078473139faa847b26450e186815651fcfe82fad50993f0d44fda6fa647eab3
Verified by: run 29 · 9whjFKVe…, NEAR transaction: 9whjFKVemMrMX668vHYLhrH1VaKZGRi7MGWmV3JQJA6U, opens an explorer in a new tab
Later proofs: none yet

Declared before open (opened with 1 known: EdgXpczE…, NEAR transaction: EdgXpczE1qzKCqmES7nCchXCdqYTRwGjH9tR2BMcWUSy, opens an explorer in a new tab). A round may never add one, and a known issue blocks no release.

view bounty.antibody.testnet.get_program({"program_id":4})

Holds if: the first known issue's tag, as committed before open

antibody status --program 4

The chains

Per chain: the program's adapter, the proxies it may pause or upgrade, and every permit near-guardian asked the MPC network to sign, with the transaction that carried it there.

Permits are EIP-712 messages the MPC network signs under this program's own path; each adapter trusts only its address, 0x6f03dcde…230d, the program's guardian address: 0x6f03dcde85f6dffa8f6d2f9617cf47e3304b230d. The adapter can pause and upgrade; it can never unpause.

Sepolia (11155111)

paused

Adapter: 0xd29e67fc…ec4c, Sepolia adapter: 0xd29e67fca96b8344063429af6e4cb554da8cec4c, opens an explorer in a new tab
Proxies: AcmeLend0x13ddc837…a79a, AcmeLend on Sepolia: 0x13ddc837a4aa76d564937dc34ca7f7238195a79a, opens an explorer in a new tabAcmeVault0x23f0f943…9f4d, AcmeVault on Sepolia: 0x23f0f94338485f422b76620a1a6e4d0349379f4d, opens an explorer in a new tab

Permits on Sepolia
Permit	What it does	Status	Transaction
#12	Pause, for the ticket of commit 12round 0	confirmed on chain	0xc3ad39bf…, Sepolia transaction: 0xc3ad39bfa59498c081bfb2105bc46f0d00150f586722ceb680241261d0e54058, opens an explorer in a new tabrecorded run

Base Sepolia (84532)

paused

Adapter: 0xd29e67fc…ec4c, Base Sepolia adapter: 0xd29e67fca96b8344063429af6e4cb554da8cec4c, opens an explorer in a new tab
Proxies: AcmeLend0x13ddc837…a79a, AcmeLend on Base Sepolia: 0x13ddc837a4aa76d564937dc34ca7f7238195a79a, opens an explorer in a new tabAcmeVault0x23f0f943…9f4d, AcmeVault on Base Sepolia: 0x23f0f94338485f422b76620a1a6e4d0349379f4d, opens an explorer in a new tab

antibody judge --program 4

The sealed feed

Every commit in order: who, when, the state, the verdict and the payout; never the proof. A proof stays sealed until disclosure, and the project reads only the proofs it pays for.

Zero-knowledge proofs: none yet

The sealed feed, in commit order
Commit	Who	When	State	Verdict	Keys	Payout
Commit 12#0 · round 0	agent-a.antibody.testnet, account: agent-a.antibody.testnet our fixture agent A	2026-11-03 16:06:39 UTC6sYougyN…, NEAR transaction: 6sYougyNVacMySmhkRf6BmAxp7Fczw6F4uPyoHGiJYuU, opens an explorer in a new tab	Paid	ViolationAttested on NEAR	solvencye509d5ff…, tag of solvency: e509d5ffa3c37cb943f14abd9e9364bf21cb6306547bde28eae54b83eeb89697	0.1 wNEARVEyFZX4d…, NEAR transaction: VEyFZX4deNiZdd52HQWvQjk7yU2wL8eKGyvMhx7UQoU, opens an explorer in a new tab

A key is a rule and the entry point that broke it: the first proof of each key is paid; a later one is a duplicate that keeps its own proof record. Each commit's page shows its proof card and how to check it.

antibody status --program 4

Rounds and the release gate

A round ships a fix as code overrides at the same anchor. The enclave checks it, every paid proof is re-run against it, and a release permit is signed only for code that every paid proof fails against.

No round yet: this program still runs its round-0 code. A round is how a fix ships, and only a fix every paid proof fails against is released.

The ledger

Every movement of the escrow keeps funded equal to available + reserved + paid + fees + returned. Amounts in wNEAR, which has no value on testnet.

balances

Where the escrow is

Available	0.300
Reserved	0.000
Paid	0.100
Fees	0.000
Returned	0.000
Funded	0.400

What came in

Deposits	0.400
Forfeited bonds	0.000
Challenge bonds	0.000
Funded	0.400

Forfeited bonds go to this program's escrow, where they pay future findings: never to us.

The audit

Accounted: 0.4
Reservations: 0 · held by the commits; equals reserved when it balances
Debt: 0 · owed and not yet funded, queued in commit order
Defaulted: 0

view bounty.antibody.testnet.audit({"program_id":4})

Holds if: ok: true (funded equals accounted, and reserved equals the commits' reservations)

antibody view --contract bounty.antibody.testnet --method audit --args '{"program_id":4}'