Skip to content

Concluded

Public double-check of an institutional audit

SpecSiege of ERC-6909 Bond Platform

European Project for DLT-Enabled Financing of SME Digitalization for Crisis Recovery

Find the bugs. Take the pot.

€15,000
Total pot
Jun 4, 15:00 UTC
Start
Jun 14, 15:00 UTC
End

Outcome

Contest concluded

Findings from this contest are confidential and are not disclosed. The figures below summarize the review at a high level.

34
Researchers
117
Valid findings
~6,000
Lines reviewed
€15,000
Paid to researchers

Overview

About the platform

The codebase under audit is a bond issuance and trading platform built on ERC-6909 (the Minimal Multi-Token Interface). It implements the full institutional bond lifecycle: entities and company smart-contract wallets are onboarded through dedicated registries; bond publication, issuance, and lifecycle accounting run on top of ERC-6909 multi-token mechanics; access to every privileged operation is gated by a policy-module system with configurable wallet roles; and an escrow-backed negotiated marketplace handles secondary trading with asset-aware settlement.

Attack surface

Scope

~6,000
Source lines of code
TBD
Contracts in scope
ChainEBSI ↗PlatformEVMLanguageSolidity

In scope: contracts/...

Out of scope: tests, deployment scripts, third-party libs.

Rewards

Prizes

Contestant pot
Paid out when the contest produces at least one valid Critical, High, or Medium finding
€13,000
Lead researcher
Fixed fee, paid separately from the contestant pot
€2,000

The contestant pot is split by severity, with Critical findings taking the largest share and the remainder rolling down through High and Medium. Low findings count toward reputation only, except in the fallback case below.

How the contestant pot is split

The €13,000 contestant pot is shared among accepted Critical, High, and Medium findings by points. It is paid only when the contest produces at least one valid Critical, High, or Medium finding. The full pot is always distributed in that case; decay changes how it is divided, not how much is paid.

Critical
6
points
High
3
points
Medium
1
points
  • A finding's share of the pot is its points divided by the total points of all accepted Critical, High, and Medium findings, times €13,000.
  • A duplicated finding earns fewer points: its severity points are multiplied by 0.85 for each finder beyond the first (0.85^(n-1) for n finders). That reduced value is then split equally among those finders, so a widely-found bug earns a smaller share of the pot, both as a finding and per researcher.
Worked example (figures rounded). One Critical found by 1 researcher (6 points), one High found by 3 researchers (3 × 0.85² = 2.17 points), one Medium found by 2 researchers (1 × 0.85 = 0.85 points). Total 9.02 points. The Critical is worth €8,650 to its single finder. The High is worth €3,125, or €1,042 each. The Medium is worth €1,225, or €613 each.

If no Critical / High / Medium finding is produced

The €13,000 contestant pot is not distributed. CODESPECT instead pays a €5,000 pool across the valid Low-severity findings: the pool is divided equally by the number of Low findings (for example, 10 Lows make each worth €500), and each finding's amount is then split equally among the researchers who submitted it. Researchers banned for AI-generated low-quality submissions ("AI slop") are excluded.
Rules, judging & severity

The judging contract and severity model are the same across every SpecSiege contest.

Read the rules