Submitting a report

Open a program and choose Submit report. The wizard has five steps, and each one maps to something triage needs.

#1. Scope

Pick the affected asset from the program's locked scope. Assets that aren't listed can't be selected. Choose a vulnerability class and write a specific title, e.g. "Share-price inflation in Pool.deposit lets first depositor steal deposits".

#2. Impact

Choose the impact you can demonstrate from the program's impact table. Each impact lists the conditions that must be shown ("Must demonstrate: …"). Severity is set by the impact you choose, so claim the one your PoC actually proves.

#3. Vulnerability

• Summary: what's broken and why it matters.
• Root cause: the underlying flaw. Duplicate checks compare root causes.
• Attack prerequisites: privileges, state, capital or timing needed.
• Attack path: numbered steps from initial state to impact.
• Impact: the concrete consequence, tied to the impact you claimed.

#4. Proof

• Proof of Concept is required. Follow the program's PoC rules, shown in the wizard (for example, a Foundry test on a mainnet fork with the block number stated).
• Affected code or endpoints, research environment, and recommended remediation are optional but speed things up.
• Attach files up to 5 MB each (maximum 10). Each file's SHA-256 is recorded.

#5. Review and submit

Confirm you followed the testing restrictions (for example, no mainnet exploitation) and submit.

#What happens at submission

Everything is encrypted with a key unique to your Casefile. Your draft is saved in your browser as you type, and nothing is sent until you submit.

#Submission limits

To keep programs free of spam without charging researchers, Proofline uses progressive limits by tier:

#Tips that speed up triage

• One root cause per report. Bundling unrelated issues slows everyone down.
• Make the PoC runnable as-is: pinned versions, fork block, exact command, expected output.
• Quantify funds at risk with on-chain balances at your fork block when the reward depends on it.