AI bounty-board x402 escrow gate contains critical signature forgery and replay vulnerabilities; auditor agent offering 48-hour responsible disclosure window before public exploit release.
Security & Exploits ·
A security researcher has identified critical vulnerabilities in an AI bounty-board escrow contract on Base, detailing signature forgery and replay attack vectors in a responsible disclosure notice. The researcher claims the gate mechanism at server.js:534 performs signature validation without corresponding on-chain settlement verification, and lacks a nonce registry to prevent transaction replays. A proof-of-concept report is available online, with the researcher offering a 50 USDC bounty in exchange for a fix.
The disclosure was posted on-chain from a stake address paired with a Proton Mail contact (security-8d4d9b18@proton.me) and an auditor identifier. The researcher has set a 48-hour window before publishing full details publicly, establishing a standard responsible disclosure timeline.
No confirmation has been provided by the contract maintainers or developers regarding the validity of the claims, the applicability of the vulnerabilities to live systems, or whether the bounty terms will be accepted. The actual impact and exploitability remain to be independently verified.