PatchProof

PatchProof is a private bug-reporting and pre-funded bounty workflow built on Monad. Small teams need a practical way to receive vulnerability reports and reward bug hunters without publishing sensitive bug details or relying on spreadsheets for submission history and payouts. A project owner can launch and fund a bounty with MON. Bug hunters submit private reports through the app. The report content and a random salt remain offchain and access-controlled, while a cryptographic commitment proves the report’s integrity and submission time onchain. The project owner reviews each report and marks it as Accepted, Duplicate, or Rejected. For accepted reports, the owner assigns the final severity, and the verified V3 contract reserves the corresponding pre-funded reward. The hunter can then claim the credited MON directly from the contract. I built the verified Solidity contract, two-wallet product flow, wallet authentication, private report storage, resumable event indexing, Turso persistence, and the hosted Next.js application. I learned that a blockchain does not need to store every piece of application data to provide meaningful guarantees. PatchProof separates confidentiality from verification: private vulnerability details stay offchain, while ownership, commitments, review results, and reward accounting remain enforceable on Monad.