No Bugs Left Behind. Onchain. Transparent. Rewarding.
The decentralized bug bounty platform for web3. Report vulnerabilities, earn rewards, build reputation. All verified onchain with EAS attestations.
Submit a Bug Report
Found a vulnerability? Report it and earn bounties. All submissions are stored on IPFS and verified with EAS attestations on Base.
Bug Bounty Feed
Browse reported vulnerabilities across web3 projects. All reports are verified onchain with EAS attestations and stored on IPFS.
Reentrancy vulnerability in staking contract
Found a reentrancy attack vector in the unstake() function that allows draining of staked funds before balance update.
Integer overflow in token minting
Unchecked arithmetic in mint function allows overflow attack to mint unlimited tokens.
Flash loan oracle manipulation
Price oracle can be manipulated via flash loan to liquidate positions unfairly.
Signature replay attack in permit function
Missing nonce check allows replay of EIP-2612 permit signatures across chains.
Denial of service in batch transfer
Unbounded loop in batchTransfer() can be exploited to DoS the contract via gas limit.
Timestamp manipulation in randomness
Block timestamp used for randomness can be manipulated by miners for favorable outcomes.
Missing zero address check in constructor
Constructor does not validate against zero address for critical contract parameters.
Leaderboard
Top bug hunters and reviewers in the Rebel Bot ecosystem. Build reputation, earn rewards, and climb the ranks.
| Rank | Hunter | Bugs Reported | Reputation | Total Earnings |
|---|---|---|---|---|
H4 h4ck3r.eth 0x742d...bD54 | 47 | 9,850 | 15.8 ETH | |
SE securityfirst.base 0x789d...bD54 | 38 | 9,200 | 12.4 ETH | |
WH whitehat42.eth 0x456d...bD54 | 31 | 8,750 | 10.2 ETH | |
#4 | CH chainwatcher.base 0xef0d...bD54 | 25 | 7,200 | 7.6 ETH |
#5 | BU bugslayer.base 0x123d...bD54 | 22 | 6,800 | 6.1 ETH |
#6 | DE defi_guard.eth 0xabcd...bD54 | 19 | 6,400 | 5.4 ETH |
#7 | RA randombuster.eth 0x333d...bD54 | 16 | 5,100 | 4.2 ETH |
#8 | TO tokenauditor.base 0x222d...bD54 | 14 | 4,800 | 3.8 ETH |
How It Works
Rebel Bot makes bug bounty hunting accessible, transparent, and rewarding. Every step is verifiable onchain.
Find a Bug
Discover vulnerabilities in smart contracts, DeFi protocols, or web3 applications across EVM chains.
Submit Report
Fill out the bug report form with details, PoC links, and evidence. Files are stored on IPFS.
IPFS Storage
Your report is permanently stored on IPFS, ensuring decentralized and immutable evidence.
Review Process
Project maintainers and community reviewers verify and validate your submission.
EAS Attestation
Valid reports receive an Ethereum Attestation Service (EAS) badge on Base for onchain verification.
Earn Rewards
Get paid in ETH directly to your wallet. Build reputation and climb the leaderboard.