Internal Hackathon 2026 / Rules

Rules

What this is

An internal competition to find as many real bugs as possible, anywhere they matter. Use whatever AI tools and methods you believe in. What counts is a reproducible finding with a clear impact that the team can act on.

Findings go privately to the review team. Nothing is public, and other participants never see your reports.

When

Three days: September 23 to 25, 2026.

Who

Anyone at Matter Labs can take part.

Scope

The Scope page lists recommended repositories to start with. It is not an exhaustive boundary: if you find a real, high-impact vulnerability in an older component, say a forgotten pod that has been running for five years and could seriously endanger the company, it counts. Infrastructure testing is limited to authorized internal targets and publicly reachable off-chain infrastructure.

Submitting

Submit findings through this website. Each one becomes a private Linear issue in the review team, credited to you. If you learn more later, revise the finding from My submissions; reviewers receive your changes as a comment on the original issue. Screenshots and other evidence can be attached.

Make it count.

The points are proportional to the relative payouts in our bug bounty:

• Critical: 60 points
• High: 10 points
• Medium: 3 points

Judges can adjust the score of any submission. Impact, quality and reproducibility matter more than the severity you picked. Low and informational findings are welcome but do not score. Approved points add up on the leaderboard.

Fair play

Any attempt to cheat or trick the rules will be punished. We are doing this ourselves, for ourselves. The point is safer infrastructure, not a gamed scoreboard.

For example:

• Report only what you actually found. A bug you already knew was reported, or one sitting in the bounty backlog, is not a fresh find.
• One root cause is one finding. Do not split it into several tickets.
• Stay within authorized targets. The recommended repository list is a starting point, but do not probe systems or infrastructure without authorization.
• Do not inflate severity or invent impact. Every finding is verified before it scores.

Judges decide what counts as cheating and what follows. If in doubt, ask before you act.

Judges

Philipp Durrer and Vlad Bochok have the final call on every decision: scores, disputes, and anything these rules do not cover.

Read it? Submit a finding or pick a target.