Bug Bounty Submission and Escrow Tool

WHAT IT DOES

Bug Bounty Submission and Escrow Tool is a security tool that enables researchers to submit bug reports to bounty programs with escrow-protected rewards. It reads the bug bounty contract address, bounty program details (scope and reward tiers), submission ID, submission metadata (description hash, severity, and exploit details), escrow status, bounty reward amount, submission review status (pending/accepted/rejected), review history, account nonce, gas estimates for submission and claim, and previous submission records. The tool then guides researchers through submitting a bug report, locking the bounty reward in escrow, updating submission status, and managing the review process—including releasing the escrowed reward on acceptance or returning it on rejection.

HOW TO USE

Connect your wallet via the built-in connector. Select the network where the bug bounty contract is deployed. Enter the bounty contract address, the submission metadata hash (describing the bug and exploit details), select the severity (critical/high/medium/low), enter the reward tier, and provide the payment token address (use address(0) for native token). The tool will read on-chain data and display a preview including: bounty contract, submission hash, severity, reward tier, payment token, escrow status, submission status, review history, and estimated gas. If you are a researcher, click "submit bug report" to submit the bug and lock the reward in escrow. The tool will guide you through three steps: submitting the bug report, locking the bounty reward, and recording the submission.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 to interact with the bug bounty contract. It reads bounty program details using `getProgramDetails()` which returns the scope and reward tiers. Submission metadata is read via `getSubmission(submissionId)` which returns the description hash, severity, and exploit details. Escrow status is checked using `getEscrowStatus(submissionId)` which returns locked/released. Submission review status is read via `getReviewStatus(submissionId)` which returns pending/accepted/rejected. Review history is scanned using `eth_getLogs` for `SubmissionReviewed` events, with adaptive chunking (halving chunk size on failure) to handle different RPC limits—the tool walks backward from the current block and continues even if some ranges are rejected. The submission transaction calls `submitBug(reportHash, severity, rewardTier)` on the contract, which locks the reward in escrow and emits a `SubmissionCreated` event. Gas estimates are calculated using `estimateGas` on the submission method with EIP-1559 fee data from `feeData`. All transactions are built with EIP-1559 fee data, and the tool uses `effectiveGasPrice` from receipts for accurate cost accounting.

WHAT IT CANNOT SEE

This tool cannot verify that the bug report is accurate or reproducible—it only records the submission. It cannot detect if the bug is a duplicate of a previous submission. It cannot guarantee that the bounty program will pay the reward—the program must have sufficient funds. It cannot ensure that the review process is fair or unbiased. It cannot prevent front-running of submissions. It cannot validate that the severity assessment is accurate. It cannot detect if the bounty contract has been modified. It cannot verify that the submitter is who they claim to be—submissions are pseudonymous.

PLEASE NOTE

This tool is EVM-only and supports Ethereum, Polygon, BNB Chain, Arbitrum, Optimism, and Avalanche. The submission transaction is signed by the connected wallet, and the user pays gas fees. Escrow ensures that rewards are locked until review is complete. Researchers should ensure their submission is accurate and complete before submitting. The tool does not store or transmit any bug details. Always verify the bounty program's terms before submitting. Test on testnet before using on mainnet.