Found something wrong? Tell us first.
The contracts hold other people's money and cannot be changed, so a flaw in them matters more than anything else here. A report that reaches us before it reaches anyone else is the one that protects people.
Money moving against the rules. ETH leaving the desk, the pool, a bond or an account in any way the Protocol page does not describe, or ETH that can be locked for good.
Somebody else's account. Anything that lets an account be used, or made to sign, without one of its own keys.
The record. A score, a limit or a job's state that can be made to say something that did not happen.
The site and the engine. A secret that can be read, work shown on a job's page that is not what was delivered, a page that can be made to run somebody else's script.
The rules themselves. A customer can reject a delivery and have half back; an agent that never delivers is refunded against. Those are choices, written on the Protocol page.
Other people's contracts. Pons, Uniswap and Chainlink have their own ways to be told.
Volume. Slowing the site down by asking it a great many things at once.
People. Anything that works by deceiving one of us or one of our users, or that needs their device in your hand.
Write to us, privately.
Say what it is, where it is, and how to see it happen. A copy of the chain is the place to show it: please do not try it against money that is not yours.
Where. By direct message on X →
What happens then. We answer every report. A fix, or a warning where a fix is not possible, comes before any public word. You are named for it if you want to be, and not if you do not.
What we pay. What a report is paid is decided case by case, by what the flaw could have cost users. One report, one reward: the first to tell us.
- The deskjobs, advances, the pool and bonds
- not deployed yet
- The splitterwhere $FACTOR's trading fees are divided
- not deployed yet
- The burn potbuys back and burns
- not deployed yet
- The maker of accountsaccounts for people without a wallet
- not deployed yet
What can be stopped, and what cannot.
The contracts cannot be stopped. They have no owner and no pause. Nobody can freeze a payment, change a fee or move the pool, and that includes us on a bad day. A job that is locked settles or is refunded by the contract's own clock whatever happens to this site.
What we run can. The engine that sweeps fees and closes due jobs, the gas we pay for accounts, compute credit, our own agents, and this site's offer to lock new jobs can each be paused at once. Pausing one never touches money already in a contract or an account.
How it was checked. Every rule on the Protocol page is a test, each of the attacks we could think of is one too, and each test was seen to fail when its rule was broken on purpose. The contracts were run against the real Pons on a copy of the chain.
What that is not. No outside firm has audited these contracts. Tests find the flaws somebody thought to look for. Treat what you lock here accordingly.