Break our contract. Get paid in BLK.
The BlockHaus presale contract is live on Polygon and buyers pay into it in USDT. It has not been audited by any independent firm. We would rather a developer finds a problem now than a thief finds it later.
20,000 of 20,000 BLK left in the pot.
What we pay
| Severity | Reward | What it means |
|---|---|---|
| Critical | 20,000 BLK | Anyone can take USDT or BLK out of the contract, take funds from a buyer, or change the token supply. |
| High | 15,000 BLK | Someone can buy at the wrong price, receive more BLK than they paid for, or stop the sale for everyone without the owner key. |
| Medium | 10,000 BLK | A buyer can lose funds through normal use, or an owner control does something different from what the code says it does. |
| Low | 5,000 BLK | Wrong values from a view function, wrong event data, or rounding that works against the buyer. |
The pot is 20,000 BLK in total. Rewards come out of that one pot in the order valid reports arrive, and the first person to report a bug is the one paid for it. A critical report pays the full 20,000 BLK and closes the bounty. If a smaller reward is due and less is left in the pot than it is worth, we pay what is left. When the pot is empty this page says so.
What is in scope
- Presale contract:
0x230AcddEFED9202db139C03157056631edc250D5 - BLK token contract:
0x5cF704a1F5B5555B7369F4AB971D0d1b5bcD666a
Both are verified on Polygonscan, so the source you read there is the code that runs.
What is not a bug
These owner powers exist on purpose and are listed here so nobody spends time on them. The owner key sits on a Ledger hardware wallet, offline.
- The owner can pause and unpause the sale and BLK transfers.
- The owner can open or end the sale, move it to the next phase early, set the minimum and maximum spend per wallet, and switch on a whitelist.
- The owner can withdraw the USDT raised and any unsold BLK.
- A purchase larger than what is left in the current phase is refused. The buyer has to buy the remainder, then buy again in the next phase.
Also out of scope: this website, phishing, gas savings, anything that needs the owner key stolen first, and bugs in USDT or Polygon itself.
How to report
Email hi@theblockhaus.io, or reply to the email we sent you. Include:
- the contract and the function
- what goes wrong
- how to reproduce it, ideally as a test against a fork of Polygon
- the Polygon wallet address you want paid to
Test on a fork, never against the live contract with other people's money. We reply to every report, and every one goes in the public log below with our verdict. If we rate a bug lower than you think it deserves, say so and we will set out our reasoning in the log.
BLK is a presale token. It has no guaranteed value and cannot be traded until it is listed on an exchange, and no listing date is fixed. We cannot pay rewards to residents of the United States, the United Kingdom, the United Arab Emirates, or any country under UK sanctions.
Every report so far
No reports yet.