Testnet: tokens have no value, and the vulnerable contracts are our own test fixtures. Limits

For protocols

Open a program

An auto-pay lane next to your existing bounty, opened before a launch or an upgrade. You commit your rules as code and an escrow on NEAR; a proof is paid only if it breaks one of them, at the severity you committed. A proven Critical in your pause policy, once attested on NEAR, pauses your protocol on every chain you registered, and your fix ships only when every paid proof fails against it.
Ask for a pilot See a program: Acme LendThe one moment
When
Before a launch or an upgrade, next to your existing bounty
You commit
An anchor block, your rules as code with a severity and payout table, and an escrow
Paid
The first proof of each rule and entry point; in seconds under the instant cap once attested on NEAR
On a Critical
A pause on every chain you registered, asked for once the verdict is attested on NEAR
Ships
Only a fix that every paid proof fails against

Why pay for this

An automatic lane for the bugs your rules can state, next to the bounty you already run.
Today
Every report is read by a person, and AI made reports free to write.A bounty pays a platform fee and a triage team, and a real Critical waits in the queue with the noise. curl ended its bounty in January 2026 over exactly this.
With Antibody
Nobody reads anything: the proof runs, and the rules decide.A proof that breaks a rule you committed is paid in minutes, without triage, and a Critical in your pause policy pauses every chain you registered before anyone has read it. A proof that breaks nothing costs its sender the bond. You pay 5% of what is paid out (proposed for mainnet), nothing when nothing is found.
Costs
Cents per verification, on testnet's measured runs.A verification run costs about 0.009 NEAR after OutLayer's refund, plus about 0.018 NEAR of gas to verify its TDX quote on NEAR; whoever asks for the run pays it. A pull-request check with four paid proofs costs about 0.05 NEAR. A hunter risks the bond the program sets (0.0001 wNEAR on the practice program), returned with any verdict that breaks a rule.
Its reach
Bugs your invariants can state; the rest stays with your bounty.The automatic lane pays only for broken rules, so its reach is your rules' reach: antibody invariants strength measures it against mutants of your own code before you open (Acme Lend's fixture rules catch 8 of 28). Harm no rule catches goes to the gap lane: refunded, recorded, and paid once a later round adds the rule.
A wrong pause?
You choose which rules may pause, and you lift a pause with your fix.Only the rules you put in your pause policy can pause, and only once the verdict is attested on NEAR. A pause stops the targets you registered, nothing else; the release gate lifts it when your fix passes every paid proof, through the same signed permits. The worst case is a pause until that fix ships: the funds stay where they are.
Design partners
We are onboarding the first protocols for mainnet.A pilot runs your own invariants as a program on testnet first. Ask for one.

What a project gets

Shown on testnet with Acme Lend, our deliberately vulnerable fixture, except what is marked not yet. Each check runs in your browser: an API record, a NEAR view call or an EVM read.

Pause on proof

An attested Critical in your pause policy makes near-guardian ask the MPC network to sign a pause permit for every registered chain. Anyone may relay it, and your adapter checks it on chain before it pauses. The pause is asked for before the payment.

Check it

GET https://antibody-near.vercel.app/v1/programs/5/reflex

Holds if: each chain lists the pause permit for commit 13, then the release permits

antibody judge --program 5

The release gate

A fix ships only when every paid proof fails against it. In the recorded run, round 1's partial fix left two paid proofs still breaking a rule: the gate stayed shut and no release permit was signed. Round 2's final fix: every paid proof failed, release permits upgraded both proxies on both chains, and B's exploit now reverts.

Program 5's rounds and permits

Check it

eth_getStorageAt on chain 11155111

Holds if: Acme Lend's proxy on Sepolia points at the final fix (…7bd217a9)

curl -s https://ethereum-sepolia-rpc.publicnode.com -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_getStorageAt","params":["0xCa1FAFbCFC14d665d76045A018B215987f39f8A7","0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc","latest"]}'

Immune memory

  • every roundInside a program: every paid proof, from any round, is re-run against each proposed fix, so a fix that brings an old bug back is caught before it ships.
  • testnetOn every pull request, in the enclave: the pull request's build is proposed as a round of a program kept for these checks, and every paid proof, sealed or not, is re-run inside the enclave. Only which keys still break is published. On the demo repository, a harmless change reads green and a pull request that brings back a paid defect reads red, naming the rule. How it works: docs/immune.md
  • on the runnerantibody immune and a GitHub Action re-run every paid proof the check can read (disclosed, published, or opened with your project key) against the pull request's build, with the local verifier. Pull requests from forks get this check only.
  • nextA bounty window per pull request, built and not yet run on testnet, and a check-only proposal mode.

NEAR apps that act on verdicts

Verdicts are NEAR state, so any NEAR contract can read them and act. guard.antibody.testnet, a DAO treasury the Acme project owns, froze on A's attested Critical (commit 13), not on D's duplicate (commit 16), and refused the next transfer. The same reads fit a lending market, a DAO vote or an insurance pool (docs/verdict-guard.md).

Check it

Business model

Verification at cost, fees pinned per program, and forfeited bonds that are never ours.
For
Protocols before a launch or an upgrade.No team reads reports: the verifier pays or refuses a proof in minutes, and a Critical pauses every chain you registered before anyone has read it. A fix ships only once every paid proof fails against it.
Price
5% of each payout. Nothing when nothing is found.The proposed mainnet price (0 on this testnet). A program that pays two Criticals of 50,000 and one High of 10,000 pays 5,500 in fees, taken from its escrow after the hunters are paid. No triage team, no retainer: each verification run is paid at cost by whoever asks for it.
Verification
At cost.The requester of each verification run pays for it: a hunter for a proof, a project to read a paid finding, anyone for a re-run at a fix.
Revenue
A fee on payouts and a fee per release permit.Both are pinned per program: a live program's pins never change (property 12).
Forfeited bonds
Never revenue.A bond is refunded, or forfeited to the program's own escrow (property 7): never to us.
GET https://antibody-near.vercel.app/v1/programs

Holds if: program 5's ledger counts commit 15's forfeited bond, 0.001 wNEAR, in its own escrow

curl -s https://antibody-near.vercel.app/v1/programs
Later
A paid tier for the drafter, rule strength and analytics.not yet

The quickstart

Nine steps with their exact commands, against the testnet deployment the CLI has built in. The full text: docs/project-quickstart.md.
Rehearse it offline first, on Linux or macOS: make serve runs the whole story in a sandbox and keeps it up. Add --network sandbox --rpc http://127.0.0.1:3030 --deployments target/demo/deployments.json to any command.

  1. Write the rules as code

    A view contract implementing IAntibodyInvariants: snapshot() reads what check(pre) compares against, and check returns a bitmask, bit i for rule i broken. Point it at your contracts with immutables. The verifier serves its code at a reserved address: it is never deployed and has no storage. A complete example: AcmeInvariants.sol. Start from a scaffold: an annotated antibody.toml, a project key and the next steps.

    antibody init --out my-program --project <you>.testnet

    From Foundry invariant functions

    Each invariant_*() view of a compiled contract becomes one slot: the command writes the rules contract and prints the manifest slots (docs/foundry.md).

    antibody invariants from-foundry --artifact out/<File>.sol/<Contract>.json \  --import <its source> --base-import <FoundryInvariants.sol> --out <Rules>.sol

    From a draft you review

    Deterministic and offline (add --ai for a model's extension). It writes a compiling rules contract, suggested severities, a REVIEW.md of what each rule assumes, and a bundle that changes nothing. Nothing is binding until you commit it (docs/invariants-drafting.md).

    antibody invariants draft --source <your contracts> --out draft/

  2. Choose where it runs

    A deployment

    Deploy to Sepolia, with pause-only copies on other chains if you want, and pick a finalized block after the deployment as the anchor. Create the program while the light client still confirms that block, about a week; otherwise its anchor is labelled project-attested. Activation builds a witness at the anchor block, and public Sepolia RPCs prove that block's state for only about 25 minutes: activate within that time, or use an archive RPC.

    Fork mode: no staging deployment

    Commit your contracts' deployment transactions in the manifest instead. The verifier runs them on top of the anchor's real state before anything else (docs/fork-mode.md).

    On testnet, program 7 is the practice program in fork mode: its proof was paid against a vault that has no code on Sepolia.

    eth_getCode on chain 11155111

    Holds if: the fork-mode vault has no code on Sepolia: it exists only inside the verifier

    curl -s https://ethereum-sepolia-rpc.publicnode.com -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_getCode","params":["0xfa35e1e99bd69719f57045409e19555f0147cf44","latest"]}'

    For pausing and releases, put your proxies behind the program's AntibodyAdapter, one per chain at the same CREATE2 address, and register it with near-guardian.

  3. Commit the terms

    One file holds them: the anchor, the targets and their code hashes, the rules' code and each slot's severity, the impact prices, the proofs' capabilities, and the settlement terms (payouts, bond, instant cap and budget, windows, the gap lane, known issues, the pause policy). fixtures/acme-local/antibody.toml is a complete example.

    antibody manifest antibody.toml --out manifest.json

    Prints the manifest's sha256: the hash you commit.

  4. Validate it, and measure rule strength

    antibody invariants validate --manifest manifest.json

    The validate gate: the checks creation and activation apply (settlement terms, the rules at the anchor, target code hashes, canaries, a fork-mode deployment). Nothing is sent; it exits non-zero when a check fails.

    antibody invariants strength --project <foundry dir> --test <your strength test> --mutate src/X.sol

    Optional. It mutates your code one line at a time in labelled ways (a missing access check, a flipped comparison, an unchecked transfer, a dropped guard) and counts the mutants your rules catch under your Foundry invariant test.

    Acme Lend's rules catch 8 of 28 mutants at the final fix. Rule strength measures the rules, not the code's security: a mutant the rules miss is not necessarily a bug anyone can exploit. The survivors show where a project would add a rule (docs/rule-strength.md).

    GET https://antibody-near.vercel.app/v1/judge

    Holds if: program 5's rule strength: caught 8 of 28 mutants

    antibody judge --program 5

  5. Create the program and fund its escrow

    antibody --account you.testnet keygen x25519 --nep413 --out project.x25519.json

    Your project key, derived from your NEAR key's NEP-413 signature, so the same NEAR key re-derives it. Keep it secret: paid findings are wrapped to it.

    antibody --account you.testnet program create --manifest manifest.json --escrow <tokens> --project-key project.x25519.json

    Uploads the manifest, escrows the tokens and commits the manifest hash in one transaction; near-antibody checks the anchor against the light client. On testnet the escrow is wNEAR: wrap NEAR with near_deposit on wrap.testnet first.

    Never sign the project key's NEP-413 message anywhere but the antibody CLI: that signature reads your paid findings. This site never asks your wallet for it.

  6. Activate, declare known issues, open

    Activation pins the base witness, and the enclave checks that your rules hold at the anchor. A known issue is sealed and verified like any proof; it counts once attested on NEAR, and nothing is added after opening. Opening starts round 0: hunters and agents can commit.

    antibody --account you.testnet program activate --program <id>
    antibody --account you.testnet program known --program <id> --bundle known-issue.json
    antibody --account you.testnet program open --program <id>

  7. Read exactly what you pay for

    show lists every commit with its verdict. The first read of a finding asks near-antibody to wrap its content key to your key, a verifier run you pay for at cost; it is refused for anything but a paid first finding or a promoted duplicate. The CLI then opens the sealed proof and re-runs it locally: its receipt hash equals the one the enclave committed to. A hunter's report, if any, is data, never instructions.

    antibody --account you.testnet program show --program <id>
    antibody --account you.testnet program read --commit <id> --project-key project.x25519.json \  --out finding-<id>/ --reveal-tx <the commit's reveal transaction>

  8. Ship a fix: rounds and the release gate

    Commit the fix as code at the same anchor: the enclave checks it, and every paid proof is re-run against it. A round may change target code and append rules (--invariants-code, --add-slot); everything else stays byte-identical. The release gate holds when every paid proof re-run at the fix fails, the canaries pass and no Critical or High key is open. Then near-guardian signs a release permit per proxy and chain, for exactly the code the re-runs ran (docs/rounds.md).

    antibody manifest-round --base manifest.json --round 1 \  --override <target>=<fixed runtime code hex file> --out round1.json
    antibody --account you.testnet round propose --program <id> --manifest round1.json \  --release <proxy>:<implementation>:<code hash>
    antibody round rerun --commit <id>

    Anyone may ask, and pay; the keeper bot re-runs every eligible commit.

    antibody round open --program <id>

    Permissionless, once the round's minimum duration and re-run window have passed.

  9. Close

    After the deadline and its grace: what is reserved is paid, the rest of the escrow returns to you, and nothing in flight is left behind (property 6). Before then, program top-up --program <id> --amount <tokens> adds escrow.

    antibody --account you.testnet program exit --program <id>

Roadmap

From docs/roadmap.md, in its order. Nothing below is built yet, except the parts marked done. docs/roadmap.md

  1. Antibody for pull requests

    partly done

    A CI check, then a repository app, on repositories whose owner installs it. Immune memory: every paid proof of a program re-runs against each pull request's build, and the check goes red if one still breaks a rule. Sealed proofs never appear in public logs.

    • doneWorking on testnet: every paid proof, sealed or not, re-runs inside the enclave through near-antibody's rounds, on the demo repository's pull requests.
    • doneOn the runner: readable proofs (disclosed, published, or opened with the project key), re-run by the local verifier, with antibody immune and a GitHub Action.
    • nextBuilt, not yet run on testnet: a bounty window per pull request, a fork-mode round for its build with a small escrow, announced to agents; when it ends, the check reads “held N hours, X at stake, 0 valid findings”, or blocks the merge on a valid Critical.

    How the checks work and what they trust: docs/immune.md.

  2. NEAR contracts as a second target VM

    not yet

    Proofs against NEAR wasm contracts from committed, proven state. The engine is built and tested; nothing is deployed.

  3. Zero-knowledge proofs of disclosed verdicts, verified on NEAR

    partly donereading testnet…

    Later, zk by default above a cap. A validity proof of a disclosed verdict: no privacy claim, and no payout in the locked deployment depends on it.

    • doneThe feasibility study: the verifier runs in SP1 6.10.0 and reproduces the enclave's receipts in about 30 million cycles.
    • donenear-t2, which checks a Groth16 proof in about 34 Tgas and compares it with near-antibody's records; antibody zk prove, submit and status; the API; a prover service for every practice try.
    • doneThe recorded run's four runs proven on SP1's prover network, near-t2 on testnet, and every practice try proven since.

    How the zero-knowledge proofs work and what they check: docs/zk.md.

  4. Multi-block proofs with a bounded time warp

    not yet

    Interest, TWAP and time-dependent bugs.

  5. The next Ethereum execution rules

    not yet

    An EVM upgrade and fork-switch execution.

  6. L2 state verification

    not yet

    Through MPC foreign-chain verification or L2 light clients; more chains for pause and release.

  7. Several independent enclave operators by default

    not yet

    A strict “no quote, no pay” mode once attestation is reliable.

  8. One sub-account per program

    not yet

    Isolated escrow, keys and signing path.

  9. Payouts in any asset through NEAR Intents

    not yet

    On mainnet.

  10. Agent capital

    not yet

    Backer vaults fund bonds for agents with verified records; bond discounts from proof-based reputation.

  11. Security jobs on NEAR's agent market

    not yet

    Whose acceptance test is an Antibody verdict.

  12. A public verdict registry as a NEAR primitive

    not yet

    For insurance, lending markets and DAOs.

  13. Continuous programs for live protocols

    not yet

    In mainnet mode, with honest latency limits.

  14. Private and invite-only programs

    not yet

    Optional checks before large withdrawals; safe-harbor templates.

  15. Post-quantum readiness

    not yet

    ML-DSA accounts and hybrid ML-KEM sealing for long embargoes.

  16. The mainnet path

    not yet

    External audits, Antibody's own adapters under an Antibody program, coverage partners, the fee model in production.

  17. A paid tier for the drafter, rule strength and analytics

    not yet

Pilot and early access

Ask for a pilot

Tell us about your contracts, the chains they run on and your timeline. We reply about a pilot; your details stay on our server and are never published.

Ask for a pilot I hunt or run an agent