Question 1

How does local zero-knowledge proving work?

Accepted Answer

You run the exploit against the authorized target through the ZK-PoE notary, which certifies the TLS transcript. The CLI then builds a Groth16 proof on your own machine that the attested response contained the committed secret and that the session was notary-signed. Only the proof — which reveals nothing about the exploit — leaves your device.

Question 2

When and how do I get paid?

Accepted Answer

Atomically. After you commit the proof you reveal a single-use key; the same transaction decrypts the payload for the sponsor and transfers the bounty to your wallet. There is no triage, no grading committee, and no payout queue — the smart contract is the sole judge and pays in the block it verifies.

Question 3

Can someone steal or front-run my proof?

Accepted Answer

No. The proof is cryptographically bound to your wallet address inside the circuit and to a one-time nullifier. A copied proof submitted from another address fails verification, and the nullifier makes replays impossible.

Question 4

Where is the bounty held? Who has custody?

Accepted Answer

No one. The stake and bounty transfer into the escrow contract at registration. There is no platform wallet and no admin withdrawal path. Capital is released only by the contract's immutable logic — to a researcher with a verified proof, or back to the sponsor when the program closes.

Question 5

What is the cost, and are there hidden fees?

Accepted Answer

A transparent protocol fee on each settlement, applied on-chain and visible to everyone. No opaque platform economics, no per-seat licensing, and no cut you cannot audit.

Question 6

What am I allowed to test?

Accepted Answer

Only the targets inside a sponsor's staked, opt-in program scope. The tooling refuses any target not listed in a valid authorization. Testing anything outside a program's scope is unauthorized and prohibited.

FAQ