Terms

The service

Decompile Bounty Protocol is software that lets anyone post USDC bounties on programs deployed publicly on Solana, lets hunters submit a rebuilt source for those programs, and pays a bounty when an automated replay judge finds that the rebuilt source behaves like the deployed binary. The website, the judge machine and the keeper are run by the operator of the protocol.

By posting a bounty, funding one, submitting a source or using the API, you accept these terms.

Purpose

The protocol exists for audit, interoperability and security research on programs deployed publicly on Solana. You may not use it, or anything it publishes, to plan or carry out an attack on a program or on its users.

Posting and funding a bounty

• You confirm you have a legitimate interest in the program you post a bounty on: auditing it, integrating with it, or researching its security.
• A bounty opens with at least 50 USDC. Anyone can top it up. Every deposit is a USDC transfer from your wallet to the bounty's escrow account with a Memo, signed by you in your wallet.
• Escrows are held by keys derived by the keeper. There is no on-chain program: the rules for paying and refunding an escrow are applied by the keeper's software.
• On the first PASS, 90% of the escrow is paid to the hunter's payout wallet and 10% is bought into $DECOMP and burned (held in the vault until $DECOMP exists).
• If no submission passes within 90 days, each backer can withdraw their share of the escrow.
• Programs whose source is already verified open source are refused as targets.

Submitting a source

• You confirm that the source you submit is your own work and that you have the right to submit it.
• Your archive is encrypted in your browser to the judge's key. A failing source is not published. A winning source is published on the bounty page for anyone to read and download, and you agree to that publication when you submit.
• The submission rules in the docs apply. A submission that breaks them is refused before it is built.
• Once $DECOMP exists, each submission posts a bond of 5,000 $DECOMP, returned on PASS and burned on FAIL.
• You may not submit code meant to attack the judge machine, to read its keys, or to get around the replay.

Verdicts

Verdicts are produced by software, without a human in the loop. Each verdict comes with its hashes and can be re-run by anyone with the public verifier. If a verdict is shown to be wrong by a re-run, or if a defect in the engine is found, the operator may hold the related payout while it is checked and publish the correction on the verdict page.

$DECOMP

$DECOMP is used for submission bonds and is bought and burned on payouts and by the vault rule. Nothing on this site is investment advice, an offer, or a promise about the token. Token transfers, swaps and burns are irreversible.

Chain transactions and risk

Transactions on Solana cannot be undone. You are responsible for the wallet you use, the transactions you sign and the network fees they cost. The software is provided as it is, without warranty. To the extent the law allows, the operator is not liable for indirect losses, for losses caused by the chain, by wallets, by RPC providers or by third-party services, or for the use others make of a published source.

Third parties

The protocol works with Solana, USDC, Jupiter, Phantom, Solflare, OtterSec's verification API, Solscan and pump.fun. It is not affiliated with, endorsed by or sponsored by any of them. Their marks belong to their owners.

Takedown

A rights holder or a program's maintainer can ask for a bounty or a published source to be reviewed or taken down through the takedown form. Requests are reviewed by the operator.

Changes

These terms may change. The date at the top of this page shows the last change. Bounties already funded keep the payout and refund rules they were funded under.