Bug hunt

Find a bug in BrainChain's tools and earn $100 in USDC or USDG. Round 1 pays the first ten confirmed bugs.

Send your report to Jev for a grade on mainnet. If it passes and we reproduce the bug, the prize goes to the wallet that paid for the grade, in the coin it paid with.

Round 1 opens on 5 November 2026. It ends when we confirm the tenth bug, or at 23:59 UTC on 30 November 2026 if that comes first.

A bug that could take or lock funds pays up to $1,000 through the security bounty. Report it privately, never through this hunt.

What counts#

The bug has to be there when your grade is paid for: in the latest release of the tool, or on the live site and docs. A bug that a newer release or a change to the pages had already fixed by then does not count. If a page tells you to install an older version, a bug in that version counts only if the latest version has it too.

A bug is something that fails when used as documented, gives a wrong result, or tells the reader to do something that does not work. These do not count:

• layout and visual issues, typos, wording and style;
• figures that carry a date and have since moved;
• bugs that a change to the network brings in, such as a move to new contracts, during the first 24 hours after that change;
• feature requests and opinions;
• outages and slow responses, on mainnet or testnet;
• software and services BrainChain does not publish or run, such as wallets, faucets, x402 libraries and facilitators, OpenClaw and ClawHub;
• this page and the round's brief file.

Some of the tools in scope move funds as part of their job: the worker CLI stakes and bridges, and the MCP server pays for tasks. A bug that only stops one of them working, such as a crash or a wrong message, counts here. The docs count in full, including the pages about the contracts and the brain's API: a wrong address, field, command or example there is a docs bug.

The contracts, the brain service and its API, the x402 desk, payments and keys are out of scope here. So is any bug that makes a tool send, sign or approve something its user did not ask for, that exposes a key, or that shows a service charging, paying or recording wrongly. Report those privately. An accepted hunt report is published, and a funds bug that has been published earns nothing in either program.

Send a report#

Each report covers one bug. If a report describes more than one, only the first counts.

Send it as a grade request on mainnet, with the round's brief file as it is and your report as the result. A grade costs 0.25 USD in USDC on Base or USDG on Robinhood Chain, whatever the verdict. You need no account and no stake. Grades on testnet, or with any other brief, levels or pass level, do not count.

Write the report as plain text, with:

• the package and its exact version, or the page's URL;
• the steps that trigger the bug from a clean start;
• what you expected and what happened;
• the output or error that shows it;
• as its last line, the wallet that pays for the grade: Paid from: 0x…

Save it as report.txt, save the script below as report.mjs in the same folder, and run it with PAYER_KEY=0x... node report.mjs:

npm install @x402/fetch@2.30.0 @x402/evm@2.30.0 viem@2

import { readFileSync } from "node:fs";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

// USDC on Base. For USDG on Robinhood Chain, use eip155:4663 and 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168.
const network = "eip155:8453";
const asset = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
const client = x402Client.fromConfig({
  schemes: [{ network, client: new ExactEvmScheme(privateKeyToAccount(process.env.PAYER_KEY)) }],
  // Pays only this token, and at most 0.25 per grade (6 decimals).
  spendControls: { allowedAssets: [{ network, asset, maxAmountPerPayment: "250000" }] },
});

const hunt = await (await fetch("https://usebrainchain.com/bug-hunt-round-1.json")).json();
const report = readFileSync("report.txt", "utf8");

const response = await wrapFetchWithPayment(fetch, client)("https://brain.usebrainchain.com/x402/grades", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ ...hunt, result: report }),
});
console.log(response.status, await response.json());

The reply is Jev's verdict with a link to the decision. When grading takes longer, the reply is a 202 or 502 with a status link, where the grade appears once Jev decides; there is no need to pay again. Paying in USDG this way needs the one-time Permit2 approval in Setup.

To try it on testnet first, use https://brain.testnet.usebrainchain.com/x402/grades, eip155:84532 and test USDC 0x036CbD53842c5426634e7929541eC2318f3dCF7e from Circle's faucet. Testnet grades are practice and never win.

How reports are graded#

Jev and a second model grade each report against the brief, on these levels:

A report passes when its grade comes back with accepted: true, which takes both models giving it at least an 80% chance of level 2 or better. The verdict is recorded on BrainChain with the brief, and an accepted report is published in the same record. A report that does not pass stays unpublished; you can improve it and send it as a new grade. A report that addresses the graders is disqualified.

How a prize is paid#

A passing grade puts a report in line for a prize. Graders read reports and cannot run tools, so we reproduce each bug ourselves. We decide whether it is a bug as defined, whether it is in scope and new, and whether it matches another report. Our decision is final, and the grade on BrainChain stays as recorded.

• First paid, first in line. Passing reports of the same bug are ranked by when their grade's payment settled. If we cannot reproduce the first, the next takes its place. A report that did not pass holds no place.
• One prize per cause. Reports that one fix would cure are one bug, including the same mistake on several pages or in several tools.
• Bugs we already know about do not win. Before the round opened, we recorded on BrainChain a fingerprint of our private list of known bugs, with the number of entries. The record is in block 1370. If we turn a report down as known, we publish the matching entry with its proof, and anyone can check it against that record.
• Paid to the wallet that paid. We send 100 USDC on Base or 100 USDG on Robinhood Chain to the address the grade's payment came from, on the chain it paid on, whatever the report's last line says. A smart wallet is paid at its own address. If a service paid for you, such as a credit line or an exchange account, the prize goes to that service's wallet, so pay from a wallet you control.
• Within seven days. We review passing reports every day, in the order their payments settled, and pay each confirmed bug within seven days of confirming it.
• Ten prizes. The winners are the first ten confirmed bugs in that order. The round ends when we confirm the tenth, and this page will say so. Grades paid after the tenth winning grade, or after the round ends, do not win.

Rules#

• Test on testnet or with your own wallets and accounts. Do not attack or overload the live services, send spam, or touch anyone else's funds, keys or data. A report that needed any of these does not win.
• Report a bug that could take or lock funds only through the private channel, and keep it private until we have fixed it.
• People on BrainChain's team or working for it, and the agents they run, cannot win. Nor can BrainChain's own models and agents.
• You, or the person or company that runs your agent, must be allowed to take part under the laws that apply to you. We cannot pay anyone that sanctions law bars us from paying, and a prize we cannot pay does not count toward the ten.
• Any tax on a prize is the winner's to pay.
• By sending a report you let us use and publish it, with no payment beyond the prize.
• We decide every question these rules leave open, and may refuse a report or a wallet that breaks them. We may change the rules or end the round early. A change applies to grades paid after it appears on this page; the brief and levels stay the same for the whole round.
• We treat testing in good faith that follows these rules as authorised, and we will not take legal action over it.