Kleros- Proof Of Humanity V2 rewards up to $64K in USDC

7 min readAug 25, 2024

Starting 26/08/2024, at 15:00 GMT to 04/09/2024, at 15:00 GMT

We invite all white hat hackers to join the hunt on Kleros- Proof Of Humanity V2 audit competition

All experience levels are welcome; whether you are a seasoned security veteran or an amateur, show us what you got! Prizes will be given based on the severity level of each vulnerability found.

About the Competition

Starting 26/08/2024, a new vault will open in the Hats dApp — “Kleros- Proof Of Humanity V2”.
Participants can check the contracts in scope and start searching for bugs.

Intro to the project

Proof of Humanity (PoH) is a project initiated by Kleros. It is a decentralised identity verification system that aims to create a verified registry of unique human beings. Users submit videos and other evidence to prove their humanity, and these submissions are then reviewed and verified by other users in the community, using the Kleros arbitration mechanism if disputes arise.

Short overview of the audit scope

The competition code language is Solidity and the SLOC estimation for this competition is ~3000 SLOC.

Stay up-to-date with the competition, chat with the team, and get your questions answered by joining the dedicated Discord channel on the Hats server.
All audit reports will be published in our Discord on the day of the competition. Don’t miss the latest updates and insights — join now and be the first to know!

Audit competition rewards

Deposited Amount: The deposited amount is ~$80K in USDC, making the available prize pool ~$64K in USDC.
Service Fee: All rewards mentioned in this article and on the Hats dApp UI have already deducted a 20% Hats service fee.
Severities: Low, Medium, High

Rewards and calculation

For our audit competition, the entire prize pool is up for grabs across all severity levels. Each severity level has a designated point value and a maximum payout cap.

Maximum Reward Caps per Submission:

Low Severity: 500 USDC (equals 1 point)
Medium Severity: 10000 USDC (equals 20 points)
High Severity: 20000 USDC (equals 40 points)

*For simplicity, there is a relation between the points and the cap. If the cap is 500 USDC it equals 0.78% allocation from the max rewards. from the max rewards.

Points are consistently awarded within the same severity level unless the committee decides to adjust this. For instance, both the first and second low-severity findings will earn 1 point each. This standard applies to medium and high severities as well.

Calculating the Winner’s Reward:

The formula for a winner’s reward is as follows:

Point Value = Prize Pool / Total Points*

*Awarded for the entire competition

Examples for Clarity:

Example #1:

163 Low Severity: 163 points
1 Medium Severity: 20 points
1 High Severity: 40 points

Total points: 223

In this scenario:

Value of 1 Point = 64000 USDC/223 Total points = 286,99 USDC
The rewards for this example will be as follows:
Low (163 points): $46780,2 in total
Medium (20 points): $5739,8 in total.
High (40 points): $11479,6 in total.

Example #2

10 Low Severity: 10 points
1 Medium: 20 points

Total points: 30

In this scenario:

Value of 1 Point = 64000 USDC/30 Total points = 2133,33 USDC
The results exceed the max reward per low severity, so the value of a point is adjusted.
The rewards for this example will be as follows:
Low (10 points): $21333,33 each -> $500 per each, $5000 in total
Medium (20 points): $42666,6 -> $10000

Severities

High Severity

Issues that will qualify for this bracket will be assigned 40 points.

High-severity vulnerability description:

Issues that allow a takeover of the registry:

Issues allowing the creation within a reasonable period of time (<1 month) of a very large (> than the number of profiles already registered) amount of registered identities (ex: Being able to bypass the whole vouching and challenger system to create as many profiles as you wish).
Issues allowing to take the Humanity Id of any user in a platform the user is registered (ex: Being able to change your Humanity Id to that of any user).
Issues allowing to illegally remove a very large (>50%) number of registered profiles (ex: Being able to illegally remove any user from the registry).

Medium Severity

Issues that will qualify for this bracket will be assigned 20 points.

Medium severity vulnerability description:

Issues that can lead to improper profile creation/removal but only at a small scale or to steal funds. Examples are:

Issues allowing the creation of illegitimate profiles, but not at scale (ex: Being able to bypass the vouching or challenge system, but not both at the same time).
Issues allowing to remove the Humanity Id of another user (ex: Being able to set the Humanity Id of another user to yours).
Issues allowing to take the Humanity Id of any user in a platform the user is registered but only in a specific circumstance (ex: Being able to change your Humanity Id to that of an user vouching for you).
Issues allowing to remove a profile in an illegitimate manner in a particular situation (ex: prevent the renewal of a profile).
Issues allowing to steal a non-negligible amount of funds (ex: Being able to steal the submitter deposit after a registration).

Low severity

Issues that will be qualified for this bracket will be assigned with 1 point.

Low severity vulnerability description:

Issues where the behavior of the contracts differs from the intended behaviour (as described in the comments and by common sense), but no funds or profiles are at risk.

Limitations

Reporters will not receive a bounty for any known issue, such as:

Issues mentioned in any previous audit reports
Vulnerabilities that were already made public (either by HATs or by a third party)
“Centralization risks” that are known and/or explicitly coded into the protocol (e.g. an administrator can upgrade crucial contracts and steal all funds)
Attacks that require access to leaked private keys or trusted addresses
Issues/contracts mentioned in the out-of-scope section

Submission Guidelines — High/Medium/Low severities:

General Information:

The Hats team will create a new repository called “Kleros- Proof Of Humanity V2 audit competition” under the Hats.finance organization on GitHub. The repository will be kept private until the competition starts. Hats bot will fork it on the first submission. To participate, security researchers must submit their findings on-chain, and an automatic GitHub issue will be generated in the forked repository.
How it Works: Video Explanation

SUBMISSION GUIDELINES:

Submissions should be made using our Dapp.
You can submit one on-chain submission mentioning all issues found on the repo.
All new submissions will be created on Hats forked repo on Hats: Hats GitHub

Report Format:

Please send a plain ASCII description in the following format:
[TITLE]: A short description of the issue.
SEVERITY: Either High, Medium, or Low (as per the rules).
Submission should contain at least one test demonstrating the problem and, if possible, a possible fix.

Report Template:

Description: Describe the context and the effect of the vulnerability.
Attack scenario: Describe how the vulnerability can be exploited.
Attachment:
Proof of Concept (PoC) File: Provide a file containing a proof of concept (PoC) that demonstrates the vulnerability.
Revised Code File (Optional): If possible, provide a second file containing the revised code that offers a potential fix for the vulnerability. This file should include:
Comment with a clear explanation of the proposed fix.
The revised code with suggested changes.
Add any additional comments or explanations clarifying how the fix addresses the vulnerability.
Recommendation: Describe a patch or potential fix for the vulnerability.

Due to the nature of the audit competition mechanism, the report will not be encrypted.

Evaluation:

The first participant to submit an issue following guidelines gets a bounty for that issue (issues already received or out of scope will not receive a reward).
The competition starts on Aug 26th at 15:00 GMT and ends on Sep 4th at 15:00 GMT.
Issues that we are aware of (as witnessed by any open issues in the repository) will not be eligible for the bug bounty.

Compensation and Impact

A prize pool of ~$64K USD and NFT rewards from our hacker collection will be distributed among security researchers who submit eligible vulnerability disclosures.

Compensation payment timeline:

Ten days after the competition ends, we will announce a winner list.
Alongside the winner announcement post, submitters can send disputes to the committee team and request clarification. They can also involve the Hats security team in the process. The goal is to facilitate honest and professional debate regarding disputed submissions.
Between 7–14 days after the announcement, we will publish a split contract where the winners can claim their rewards.
HATS Service Fee: A 20% deduction from the payout will always be allocated as the service fee.

Security researchers play a crucial role in fostering trust and confidence in Web3 technologies, paving the way for mass adoption. By participating in this competition, security researchers can gain recognition for their work, raise their profile, and make valuable connections in the Web3 security ecosystem. Ultimately, they can contribute to creating a more secure and equitable community.

Join Kleros- Proof Of Humanity V2 Audit Competition today and participate in the movement to secure the future of Web3 and decentralized finance. Check the Hats Finance dApp for more information and in-scope contracts.

Stay tuned and check Hats dApp:https://app.hats.finance/audit-competitions