Documentation Index

Fetch the complete documentation index at: https://docs.nex-t1.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Nexis Security Bug Bounty Program

​

Reward Structure

​

Informational Findings

​

In-Scope Assets

​

Smart Contracts (Highest Priority)

​

Infrastructure & Protocols

​

Frontend & User-Facing Applications

​

Out of Scope

​

Known Issues (Not Eligible)

1. Centralization Risks
   • Single sequencer operation (design decision)
   • Admin upgrade controls (using Safe multisig)
   • Proposer censorship (mitigated by challenge system)
2. OP Stack Inherited Limitations
   • L1 reorg handling edge cases (documented in OP Stack specs)
   • Sequencer liveness assumptions
   • Batch submission MEV

​

Eligibility Requirements

​

Submission Process

​

Step 1: Initial Report

Subject: [Bug Bounty] [Severity] Brief Description

**Vulnerability Summary**
One-paragraph description of the issue

**Affected Component**
- Contract: [name and address]
- Function: [specific function]
- Repository: [link to code]

**Severity Assessment**
[Critical | High | Medium | Low] - with justification

**Reproduction Steps**
1. Step one
2. Step two
...

**Proof of Concept**
[Code, transaction hashes, or detailed walkthrough]

**Impact Analysis**
What can an attacker achieve? How much is at risk?

**Suggested Mitigation**
How would you fix this?

**Your Information**
- Name (or pseudonym):
- Email:
- ETH Address (for bounty):
- Twitter/GitHub (optional):

​

Step 2: Acknowledgment

​

Step 3: Validation

• Confirms reproducibility
• Assesses severity
• Determines eligibility
• May request additional information

​

Step 4: Fix & Testing

• We develop and test a fix
• We may request your help testing
• Private disclosure to select auditors

​

Step 5: Reward Determination

• Severity (Impact × Likelihood)
• Quality of report
• Cooperation during process
• Whether we learned something new

​

Step 6: Public Disclosure

• 90-day disclosure window (negotiable)
• Joint disclosure or researcher solo (your choice)
• Credit in our security changelog

​

Step 7: Payment

• Paid in USDC to provided ETH address
• KYC required for rewards $10,000+ (Synaps or Sumsub)
• Tax forms required for US persons
• Payment within 14 days of disclosure

​

Proof of Concept Requirements

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.15;

import "forge-std/Test.sol";
import "../src/Agents.sol";

/**
 * Proof of Concept: [Vulnerability Name]
 *
 * Description: [What the exploit does]
 * Impact: [Financial loss amount or capability compromised]
 * Affected Contract: Agents.sol at 0x...
 */
contract AgentsExploit is Test {
    Agents agents;
    address attacker = address(0xbad);
    address victim = address(0xdeaf);

    function setUp() public {
        // Setup test environment
        agents = Agents(AGENTS_ADDRESS);

        // Fund accounts
        vm.deal(attacker, 100 ether);
        vm.deal(victim, 100 ether);
    }

    function testExploit() public {
        // Demonstrate the vulnerability
        vm.startPrank(attacker);

        // Step 1: Setup
        // ...

        // Step 2: Exploit
        // ...

        // Step 3: Profit
        assertGt(attacker.balance, 100 ether, "Attacker profited");
        assertLt(victim.balance, 100 ether, "Victim lost funds");

        vm.stopPrank();
    }
}

​

PoC Best Practices

1. Be Specific: Exact contract addresses, function names, parameter values
2. Be Reproducible: Anyone should be able to run your PoC
3. Be Safe: Don’t actually exploit mainnet or steal funds
4. Be Clear: Comment your code explaining each step
5. Show Impact: Demonstrate the concrete harm (e.g., “steals $X”)

​

Severity Classification

​

Impact Levels

​

Likelihood Levels

​

Severity Matrix

​

Payment Process

​

Reward Determination

Base Bounty (by severity)
× Quality Multiplier (0.8 - 1.5)
× Cooperation Bonus (1.0 - 1.2)
= Final Bounty

• Comprehensive PoC: +0.3
• Suggested fix: +0.1
• Multiple attack vectors: +0.1
• Clear documentation: +0.1
• Creative discovery: +0.2

• Responsive to questions: +0.1
• Help testing fix: +0.1
• Delay disclosure as requested: +0.05

​

KYC & Compliance

• Submit via Synaps or Sumsub (link provided)
• Government ID verification
• Proof of address
• Screening against sanctions lists

• W-9 form required
• 1099 issued for $600+ payments
• State-specific requirements may apply

• W-8BEN form for treaty benefits
• May require additional documentation

​

Payment Methods

• USDC on other chains (Polygon, Arbitrum, Base)
• ETH or WETH
• Bank wire (for $25,000+, minus$50 fee)

• Privacy coins
• NFTs
• Equity or tokens
• Deferred payment structures

​

Hall of Fame

​

Top Contributors

​

Notable Discoveries

​

Safe Harbor

​

FAQ

​

Contact & Support

​

Legal Disclaimer