For projects
Payout vaults
Make your reward reserve provable on-chain, pay in one click, and see exactly what the contract guarantees.
A ProoflineVault is a smart contract you own that holds your program's reward tokens (e.g. USDC). Researchers see the live reserve on your program page instead of a promise.
Who controls what
| Party | Can | Can't |
|---|---|---|
| You (owner) | Fund; pay obligations; withdraw unowed funds after a timelock; set a per-obligation cap; briefly pause new obligations | Void an obligation; withdraw owed funds; pay a different amount |
| Proofline (attester) | Sign obligations your locked rules produce; sign a void (e.g. after a mediation reversal) | Move or hold funds |
| Researcher | Claim their own obligation after its due date | Claim early, or claim more than attested |
How it works
- Deploy with your multisig as owner and Proofline's attester address. The command is in your program builder:
TOKEN=<USDC> OWNER=<multisig> ATTESTER=<shown in builder> \ WITHDRAWAL_DELAY=604800 MAX_PER_OBLIGATION=<max bounty> \ forge script script/DeployVault.s.sol --rpc-url $RPC_URL --broadcast - Fund it: approve the vault for the token, then call
fund(amount). Anyone can top it up. - Link it in the builder. Proofline verifies on-chain that the vault trusts Proofline's attester before accepting it.
- When a reward becomes payable (retest passed, or Won't Fix), Proofline signs an obligation: Casefile, researcher wallet, exact amount, and a due date (the payout SLA).
- Pay from vault in the Casefile. One transaction pays exactly the attested amount. Proofline records it only after verifying the
Settledevent on-chain. - If you don't pay by the due date, the researcher can claim it directly.
Safety properties
- Withdrawals wait a public timelock (at least 3 days; 7 recommended) and can never touch funds reserved for registered obligations.
- Cap: a per-obligation ceiling (0 means no cap) limits the damage from a compromised attester key. Loosening the cap applies immediately. Tightening waits the same timelock, so it can't be used to block an obligation that was already issued.
- Pause: in an emergency you can pause new registrations for at most 7 days, followed by a 30-day cooldown. Registered obligations stay payable and claimable.
- Fee-on-transfer and rebasing tokens are rejected, so amounts are exact.
- The owner can't void obligations; only an attester-signed void can.
Status
The contract has unit and fuzz tests in contracts/test. An independent audit is required before mainnet funds.