Post a bounty

Verifying a verdict

The one-liner

Anyone can re-run any verdict. The site serves the replayer source, a script and every corpus bundle by hash at /verifier. You need curl, tar and a Rust toolchain (cargo).

Re-run Proof #0001
SITE=https://www.decompilebounty.com
curl -fsSL "$SITE/verifier/verify.sh" | SITE="$SITE" sh -s -- 0001

What the script does

  • Downloads the verdict record from /api/v1/verdicts/<n> and reads its hashes: program, corpus, candidate, source, report.
  • Downloads SHA256SUMS and the replayer source from /verifier/, and checks the tarball's hash.
  • Downloads the corpus bundle from /api/v1/corpus/<sha256> and checks it.
  • Downloads the original ELF from /api/v1/teardown/<program>/elf and the judge-built candidate from /api/v1/candidates/<sha256>.
  • Builds the replayer with cargo build --release --locked and checks both binary hashes with it.
  • Re-runs the replay with 10,000 fuzzed cases and the published source commitment, then compares the sha256 of the report it wrote with the published one.

It ends with MATCH when your report is byte for byte the published one. Variables: SITE (required), FUZZ (default 10000), WORK (default ./decomp-verify-<n>).

Running the replayer by hand

Replay
SITE=https://www.decompilebounty.com
curl -fsSLO "$SITE/verifier/replayer-src.tar.gz"
tar -xzf replayer-src.tar.gz && (cd replayer && cargo build --release --locked)
./replayer/target/release/replayer replay \
  --original original.so --candidate candidate.so --corpus corpus.json \
  --fuzz 10000 --source-sha256 <source sha256> --out report.json
shasum -a 256 report.json
Teardown and hash
./replayer/target/release/replayer teardown --elf original.so --out kit.json --disasm disasm.txt
./replayer/target/release/replayer hash original.so

Hunters use the same replayer before submitting: build your crate, take the bounty's corpus and the original ELF, and replay. Submit only what passes locally.

What else you can check

  • The original binary's hash against mainnet: read the program account yourself and hash the ELF.
  • The corpus: every case carries its transaction signature, so each instruction can be looked up on Solscan.
  • Every USDC movement of an escrow on Solscan.
  • Each verdict's Memo record, once recorded.