Check your proof, make the impact explicit, and catch missing evidence before the triager has to ask.
Built by Tradi3, Top Ranked on Immunefi: 77th on its all-time leaderboard on 10 October 2026.
Explore a saved review of the invented Halyard Treasury. The draft claims a 3-of-5 approval bypass; the code and supplied proof support it.
Follow the finding from its claim to the deciding source lines and proof of concept. Then put your own report through the same checks.
Draft report
Example
uint256 approvals;
for (uint256 i = 0; i < signatures.length; i++) {
address signer = _recover(digest, signatures[i]);
if (isOwner[signer]) approvals++;
}
if (approvals < threshold) revert NotEnoughApprovals(approvals, threshold);
Drop files or a folder here
Source and text files. 120 KB per file. 240 KB, 50 files and 20,000 lines in total.
Named from what you paste. The review cites it by this name.
Files are read at one exact commit, straight from GitHub to this tab.
A read-only token. It goes to api.github.com from this tab and is forgotten on reload.
Optional. Tell the review what to focus on. Left empty, it uses its standard request.
Uses your OpenRouter account, not Bounty Operator credit. A free Bounty Operator account still covers one hosted review per UTC day. Free provider capacity and limits can change; there is no automatic switch to a paid model.
The check fetches public model metadata only. It sends no files or API key.
For private reports, check the model host’s data policy first. Free routes, limits and privacy.
ConnectedOpenRouter key held in this tab.
Held in memory for this tab and sent with the review request. Never stored. Create a key
New to Novita? Create a Novita account (affiliate link). We may earn a commission if you sign up and pay for Novita through this link. Commission does not determine our defaults or rankings.
Check Novita’s current model pricing and available credit, then create a key and paste it above. Novita bills model usage separately; Bounty Operator credit does not pay Novita. A Bounty Operator account is still required: Free covers one hosted review per UTC day. Novita setup and privacy.
Eight stages on one finding, each reading the ones before it. The gates that end a report run first.
Two to four models review the same files at once. One of them then cross-examines the reviews against the source and keeps what the code proves.
Paste the prompt into a new chat with any model. It carries the method and your files, every line numbered.
The result view and the packet are built in this tab. Nothing is sent.
In the invented Tessera Staking example, the reward-theft finding holds, but the evidence does not support a loss of staked principal.
Draft report
Example
function stake(uint256 amount) external {
if (amount == 0) revert ZeroAmount();
_updateGlobal();
balanceOf[msg.sender] += amount;
The 54-second walkthrough follows this saved example from the draft to the cited code and downloadable packet.
Working in a coding agent? Watch the MCP walkthrough.
One decision, with the file and line behind it. The draft stays yours to rewrite.
Every decisive claim is backed by the supplied code and proof. File it.
The finding holds. The draft misstates its severity, impact, preconditions or fix.
The claimed impact is not demonstrated on the real path yet. One artefact is missing.
A known issue, an audit note, a branch or your own earlier report has the same root cause or the same fix.
The code contradicts the root cause, the behaviour is the design, or the rules exclude it.
Operator includes US$2 in Bounty Operator API credit per paid month. Other model providers bill usage separately.
US$0
No card or email.
US$10per month
Everything in Free, plus:
Billed monthly. Cancel any time in the Stripe portal and keep access until the paid period ends. Full plan comparison · Terms
Choose a model from OpenRouter, Anthropic, OpenAI, Google Gemini, xAI, DeepSeek, Mistral, Groq, Novita AI, Nebius Token Factory, Infron, OrcaRouter or Bounty Operator, on your own API key.