Frequently asked questions

No. Proofline does not require researchers or projects to purchase, hold, or stake a platform token to submit findings, operate a bounty program, receive rewards, or participate in case resolution.

Your reward still gets paid. Once a finding is established as valid, in scope, and meeting its impact, the reward becomes an obligation under the locked program rules. A project can record a Won't Fix decision for real reasons such as architecture, a planned migration, or accepted risk. That decision is recorded on the Proofline, and the case goes straight to payout. Validity, the reward, and remediation are separate questions. Proofline has no "no fix, no pay" rule.

No. Proofline is deposit-free by default and relies on reputation and progressive submission limits. A small number of unusually large programs may enable a refundable bond. If one does, valid reports, private duplicates, known issues you couldn't have known about, and good-faith misses all get it back. Only demonstrable spam or abuse can forfeit it, and a forfeited bond goes to the program's reward reserve, never to Proofline.

Projects pay 7.5% of paid bounty rewards at launch, billed on top of the reward. Researchers never pay and always receive the full reward. See pricing.

No. Every report is locked to the program version that was live when you submitted it: scope, impacts, severity table, rewards, SLAs, and policies. Later versions never apply to your report, and the version's fingerprint is shown in your Casefile.

No. The platform verifies that the earlier report exists, predates yours, and qualifies, without showing you its contents. A private duplicate is a neutral outcome. It doesn't lower your Proof score or your accuracy.

Every adverse decision must cite a locked rule and give a reason. You get 48 hours to file one final rebuttal with evidence. If the project upholds its decision, you can request independent mediation. The mediator publishes a reasoned decision to both sides, covering the question, the evidence considered, the finding, and the applicable rule.

With a formula published before the contest starts. A group's value is its severity points × 0.9^(n−1), split between the n duplicates, and the best write-up gets +30%. Your share of the prize pool is your points divided by all points. None of the pool is paid at the platform's discretion.