Rules

A three-day internal competition to find real, reproducible security issues wherever they matter.

Anyone at Matter Labs can take part.

Anyone who submits at least one finding can order pizza on Matter Labs during the hackathon. 🍕

Scope is a starting point, not a hard boundary. You can report serious vulnerabilities outside the recommended repositories.

Submit here

The website creates a private Linear issue credited to you.

Add evidence

Attach screenshots and supporting files to make the finding reproducible.

Revise later

Use My submissions. Reviewers receive your changes as comments on the original issue.

The points are proportional to the relative payouts in our bug bounty:

Low and informational findings are welcome but do not score. Approved points add up on the leaderboard.

Keep it honest and work independently. We are doing this ourselves, for ourselves. The goal is safer infrastructure and a fair scoreboard.

That means:

• This is an individual competition. Do not form teams or coordinate the discovery, validation, or submission of findings with other participants.
• Report only what you actually found. A bug you already knew was reported, or one sitting in the bounty backlog, is not a fresh find.
• One root cause is one finding. Do not split it into several tickets.
• Stay within authorized targets. The recommended repository list is a starting point, but do not probe systems or infrastructure without authorization.
• Do not inflate severity or invent impact. Every finding is verified before it scores.

Judges decide what counts as cheating and what follows. Deliberate attempts to manipulate the rules may lead to disqualification. If in doubt, ask before you act.

Philipp Durrer and Vlad Bochok have the final call on every decision: scores, disputes, and anything these rules do not cover.