Real proof, locally verified
A RISC Zero 3.0.6 receipt was generated and verified against the compiled guest image.
An open research lab
Private evidence.
Verifiable claims.
Can a researcher prove they found a bug before revealing how it works? zkbounty explores that question with zero-knowledge proofs and a path toward shielded bug bounties.
Research prototype · Rust + RISC Zero · Zcash research
01 / THE PROOF PATH
01
Private counterexample
A witness that passes a flawed rule and fails the intended one.
02
Pinned zkVM program
RISC Zero checks the fixed predicate and commits to the evidence.
03
Verifiable receipt
The verifier checks the program, bounty, and claimant context.
The witness stays outside the public journal.
Current scope
A pre-fix node has confirmed ordinary Orchard deposits and a spend. Two pre-fix Orchard 0.13.1 Action proofs also verify for one synthetic note. No node-confirmed double-spend, excess withdrawal, full exploit receipt, or Sepolia payout has been completed. Taylor Hornby reported the original issue in the published advisory ↗.
01 / THE FIRST EXPERIMENT
A missing binding.
A provable counterexample.
The model has two base values. Its flawed rule uses loop_base without binding it to base. A researcher can choose values that satisfy the flawed rule while violating the intended rule.
The guest accepts that counterexample and produces a receipt. This tests the proof workflow; it does not reproduce the Orchard circuit.
Read the proof statementTeaching examplemod 97
- base
- 5
- loop_base
- 9
- scalar
- 7
- output
- 63
Flawed rule accepts
7 × 9 = 63 Intended rule rejects
7 × 5 = 35 ≠ 63These values are public teaching data. Real submissions need private witnesses and fresh random salts.
02 / OBSERVED RESULTS
A working foundation.
Context checked
Wrong bounty and claimant IDs, a modified journal, and development receipts were rejected.
Evidence committed
The journal carries target, bounty, claimant, and salted evidence commitments. Arithmetic inputs and salt stay outside it.
The teaching receipt was verified on October 11, 2026. The historical Orchard circuit comparison followed on October 12. Proof generation stays local; this website describes the project.
03 / RESEARCH NOTES
Follow the evidence.
Source revisions, reproducible checks,
and explicit limits.
01
Historical Orchard pilot
Two Action proofs for one synthetic note, a confirmed ordinary node baseline, and the remaining exploit and payout gates.
Read the evidence 02Proof protocol
What an accepted receipt means, how context is bound, and where disclosure and settlement still need work.
Read the protocol 03Validation & limitations
Completed local experiments, pinned toolchains, selected upstream regressions, and claims not yet established.
Read the results04 / WHAT COMES NEXT
From a small model
to a real protocol.
A receipt proves a particular program ran on a counterexample. Establishing a real vulnerability and authorizing a payout require more work.
Track feature readiness- Open
Confirm the full historical exploit
Package both Action proofs into transactions and confirm synthetic withdrawals on an isolated pre-fix node.
- Open
Prove the replay in RISC Zero
Verify the full historical transaction sequence and pool accounting in a real private receipt.
- Open
Test the manual payout
Review the private report, approve a bound claim, and pay the Sepolia escrow to the claimant.
BUILT IN THE OPEN
Inspect it. Reproduce it.
Help sharpen the claim.
The Rust source, local proving workflow, and research record live together in the original zkbounty lab.