Break Midas Chain
before mainnet does.

Overview

Midas Chain is an OP Stack L2 that settles to Ethereum, with MIDS as its native gas token. Before it carries real money, we are paying security researchers to find what is wrong with it.

• Two tracks: the chain's own contracts, and how the chain is configured and exposed to the internet.
• Each High or Medium is a separate submission with a working proof of concept. Low findings go in one QA report per participant.
• Rewards come from a fixed pool, split by severity and by how many people found the same bug.
• Submissions go through the encrypted portal only, and stay private until the results are published.

Scope

The code under review is published as its own repository, pinned to one commit of the Midas monorepo, with the tests, a chain overview for auditors and the known issues. The repository link appears here when the contest opens.

Chain contracts

The MIDS issuer, the only way MIDS is issued on the chain (a 20,000,000,000 lifetime cap, burns that never free room under it, and a 48-hour queue the guardian can cancel); the vault that holds every user's balance for every application on the chain; the fast exit bridge; and the MIDS token's ERC-20 representation.

Chain configuration and public endpoints

The op-deployer intent and the rendered genesis and rollup files (custom gas token, roles, fee recipients), the node stack's flags, and the public RPC front door with its method allowlist.

Known issues

The scope repository's KNOWN_ISSUES.md lists the trust assumptions and accepted risks. Restating one earns nothing; showing one is worse than stated is in scope. The main ones:

• One sequencer. Censorship resistance comes from forced inclusion through Ethereum, not from the sequencer.
• Safes own every upgrade and admin role. The admin Safe can upgrade the gas token's predeploys, and with them the issuer's rules. Findings that need a Safe to act maliciously are out of scope.
• Settlement engines on the vault are trusted for what they move; the vault guarantees who can become one, and with how much notice.
• The fast bridge trusts its attestor. Anyone else releasing escrow, or blocking a refund after expiry, is in scope.
• Gas fees are collected by the fee vaults and swept to the treasury, not burned.
• Volumetric denial of service against the public RPC is out of scope. A request that stops, rewinds or reaches a forbidden namespace of the node is in scope.

Out of scope

• Unmodified upstream OP Stack contracts and clients. How Midas configures them is in scope; bugs in them go to Optimism's own bounty.
• Applications: Pactol, Predikon, Lydos, and the Midas Dollar (MDLR) and Midas Gold (MGLD) stablecoins. They get their own review before their mainnet launch.
• Testnet-only code, mocks and faucets, and files in the scope repository marked as context.
• Third-party services, the websites and this portal (report those through security.txt).
• Anything that needs a compromised admin multisig, operator key or host, social engineering, phishing or physical access.

Severity

Severity is impact combined with likelihood, judged on the scope as deployed, with the known issues as given.

Likelihood is how easily and how often the conditions arise: who can trigger it, what it costs, what has to be true first.

Rewards

The pool is set in US dollars and split 90% for High and Medium findings and 10% for QA reports. Every award is computed in dollars and paid in MIDS, vested, as set out under payment below.

• Valid findings of the same bug form one group. Each finder of a group with n finders earns points: High 10, Medium 3, multiplied by 0.9 to the power of (n - 1), divided by n.
• The best write-up in each group is selected for the report and earns 30% more. A partial duplicate earns 25%, 50% or 75% of a full share.
• The High and Medium pool is paid in proportion to points.
• The QA pool is shared equally by the reports graded A; the best QA report counts twice. Grades B and C earn nothing.
• If there is no valid High or Medium, the High and Medium pool joins the QA pool.

Example: one High found by three people and one Medium found by one person. Each High finder earns 10 x 0.81 / 3 = 2.7 points, the selected one 3.51; the Medium finder earns 3. Total 11.91 points, so the Medium finder gets 3 / 11.91 of the High and Medium pool.

Payment in MIDS

• The MIDS amount of an award is its dollar amount divided by the reference price: the price in US dollars per MIDS, stated before the contest starts. It does not change after the start.
• MIDS exists from Midas Chain mainnet onward. After mainnet genesis, the awards are minted into a vesting contract on Midas Chain, one grant per winner.
• Every grant has a 12-month cliff that starts on the results date. Nothing can be released before the cliff ends.
• A grant is created only for a winner who has passed KYC and set a payout address in the portal, and it pays that address only.
• The vesting contract's address and source are published on this page when it is deployed.

Timeline

Judging and escalation

• Judges triage every submission, group duplicates, set the final severity, grade QA reports and select the best write-up in each group.
• Judges are named reviewers who do not take part. A judge's wallet registered as a participant loses both roles until the conflict is resolved.
• When judging ends, you see the status, severity and grade of your own submissions and have three days to escalate each one once, with reasons tied to the code and to these rules.
• Results are published only after the escalation window closes and every escalation is answered. The judges' decision after escalation is final.

Rules

1. Submit only through the portal at onmidas.xyz/audit/portal, while the contest is live. Nothing sent anywhere else counts.
2. One High or Medium per submission, with a proof of concept that runs against the scope repository at the pinned commit. One QA report per participant for every Low finding.
3. Write in English. Say what breaks, where, for whom, and how you would fix it.
4. Test locally or on a fork. Never test against the public testnet, its RPC, any live system or other people's funds.
5. Keep findings private until the results are published. Publishing or sharing a finding earlier disqualifies it and its author.
6. One identity per person. Duplicate accounts, collusion and plagiarism disqualify every account involved.
7. Findings generated without understanding, such as unverified tool output, are invalid. Repeated spam can lead to suspension.
8. The judges decide severity, validity and duplicates under these rules. Midas may change the rules before the contest starts; the version you accepted at registration applies to you.

Eligibility and KYC

• Anyone may take part, except Midas staff, contractors and their families, the judges, and anyone who reviewed this code for Midas before.
• Winners must pass identity verification (KYC) before their grant is created. People in sanctioned jurisdictions, or on a sanctions list, cannot be paid.
• You are responsible for any tax on your reward. Midas may need tax information to pay you.
• A payout address that can hold MIDS on Midas Chain must be set in the portal before a grant is created. The grant pays that address only.

Safe harbor and disclosure

If you research within these rules, Midas treats your work as authorized: we will not bring legal action against you or ask anyone else to, and we will say so if a third party does. The rules that keep that promise:

• Use only your own accounts, test networks, local deployments and forks. Do not access, change or destroy other people's data or funds.
• Do not degrade or interrupt any live service, including the testnet and its public RPC.
• Report through the portal and keep the finding confidential until the results are published, or until Midas agrees to earlier disclosure in writing.
• A vulnerability in a live system found outside the contest goes to the address in security.txt, not to the portal.

Safe harbor covers your research under these rules. It does not cover breaking any other law.

Leaderboard

The leaderboard appears here when the judges publish the results.

FAQ