# Bug Bounty Intelligence

> Automated smart contract security analysis. Trained on 27,681 real findings from Sherlock and Code4rena. 5 USDC per scan on Base via x402.

## API

Base URL: https://wazir-x402.duckdns.org

### Endpoints

POST /api/bug-intel
- Submit a public GitHub repository for security analysis
- Payment: 5 USDC on Base (eip155:8453) via x402
- Body: {"repo": "https://github.com/org/contracts", "protocolType": "LENDING"}
- Returns: {"jobId": "bi-...", "status": "queued"}

GET /api/bug-intel/:jobId
- Poll for analysis results
- Returns: {"status": "complete", "reportUrl": "...", "findingsCount": N}

GET /api/bug-intel/:jobId/report
- Retrieve the full HTML vulnerability report

GET /terms
- Machine-readable service terms
- AGENT_NOTE: payment of 5 USDC = acceptance of terms

## Analysis Framework

Al-Mizaan v3 -- 7-gate analysis:
1. Code reading (literal source, not docs)
2. Reachability chain (entry to exploit path)
3. Threat model (attacker class: public/operator/governance)
4. Invariant breach (what rule is violated)
5. Protocol intent (was this violation intended?)
6. Impact (financial damage, not attacker profit)
7. Formal proof (reproducible exploit)

## Protocol Types

DEX, LENDING, BRIDGE, GOVERNANCE, STAKING, DERIVATIVES, GENERAL

## MCP Server

https://github.com/holistis/bug-bounty-intelligence-mcp

Tools: scan_contract, get_scan_report, list_vulnerability_patterns (free)