Bug Bounty Batch Payout Tool (Ethereum L1)

WHAT IT DOES

This tool enables organizations to batch pay bug bounty rewards to multiple security researchers in a single transaction on Ethereum L1. Instead of sending rewards to each researcher individually and paying gas for every transfer, it combines all bounty payments into one call to a shared batch-sender contract. The tool reads your token balance, allowance, and the current gas price before submitting the transaction. You specify the token contract address, the decimals, an optional program name, and a list of researcher addresses with per-researcher bounty amounts. The tool computes the total tokens to distribute, checks your balance, verifies you have sufficient allowance for the sender contract, and submits one transaction that pays all researchers atomically. If allowance is insufficient, the tool automatically requests approval before sending. This is a true push distribution — researchers receive their bounties directly without any claim action required. The tool works with any ERC-20 token on Ethereum L1, making it ideal for security programs, bug bounty platforms, and vulnerability reward programs.

HOW TO USE

Connect your EVM wallet via the BotGentz wallet bridge. Select Ethereum L1 (chain ID 1) from the network dropdown (or any EVM chain). Enter the token contract address and its decimals. Optionally enter a program name for record-keeping. In the text area, list each researcher on a separate line with their address and the bounty amount to send, separated by a comma. Amounts should be in base units (not including decimals). Click "Review bounties" to see your token balance, allowance, the sender contract fee, and the total amount being distributed. The tool will display a warning if your allowance is insufficient. If everything looks correct, click "Pay bounties" — your wallet will first ask you to approve the token spend if needed, then to confirm the batch transaction. Once confirmed, the tool shows progress and the final transaction hash with a link to Etherscan. This is ideal for bug bounty programs, security researcher rewards, and vulnerability disclosure payouts.

TECHNICAL MECHANISM

This tool uses the BotGentz shared bulk-sender contract registry, keyed by chain ID and ERC standard. It looks up `BULKSEND[String(chainId)].erc20` to get the sender contract address for the current chain. On Ethereum L1 (chain 1), the sender contract is `0xE0F4E170C434071b167ABA0e64DC3689536f2E07`. The tool creates a contract instance using `BGWallet.getSigner()` connected to the current chain's provider. It calls `fee()` and `owner()` on the sender contract live — no values are cached. It also instantiates the token contract using the ERC-20 ABI and checks `balanceOf()`, `allowance()`, and `decimals()` for your wallet. The tool computes the total token amount from the researcher list and verifies both your token balance and native balance (for the sender contract fee) are sufficient. If allowance is insufficient, it sends an approval transaction for the exact total amount (not unlimited) before the batch transfer. The batch transfer uses `batchSend20(address token, address[] recipients, uint256[] amounts)` on the sender contract, sending the contract fee as `msg.value` in native tokens. The sender contract then iterates the researcher list and transfers bounties atomically within the same transaction using `transferFrom` from your wallet. After confirmation, it logs gas usage using `receipt.effectiveGasPrice`.

WHAT IT CANNOT SEE

This tool cannot verify bug report validity, severity assessment, or researcher eligibility. It cannot confirm that the reported vulnerabilities are genuine or that the severity ratings are accurate. It cannot verify that researchers meet the program's eligibility criteria. It cannot confirm recipient wallet readiness or guarantee that researchers can receive ERC-20 tokens. The tool does not validate that the token contract implements the ERC-20 standard or has the required `transferFrom` function. It cannot detect front-running or mempool congestion. It cannot provide a cross-chain receipt or rollback mechanism. It also cannot verify that the decimals value you entered matches the actual contract decimals — the tool warns but does not automatically correct discrepancies. Organizations should always validate bug reports and severity assessments before paying bounties.

PLEASE NOTE

This tool is EVM-only. It works on Ethereum L1 and other EVM chains where the BotGentz registry has an erc20 entry. It does not support Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, or XRP. The tool requires the token contract to be deployed on the chain and for the sender contract to have an erc20 entry in the registry. Always test with a small amount and a single researcher before paying out full bounties. The sender contract charges a fee in native tokens — ensure you have enough native balance to cover the fee. This is a push distribution — the sender pays all gas, researchers receive bounties without any action. Bug bounty programs should maintain thorough validation processes before using this tool.