{"rewardSnapshot":null,"merkleRoot":null,"claims":null,"id":"2844d117-8ac6-4d50-b205-1b4aa254b52b","launchNumber":2194,"kind":"evm_contracts","status":"live","chainId":4663,"sourceRepoUrl":"https://github.com/identity-md-launches/launch-2194-update-existing-bounty-box","sourceCommit":"fd99ae4b0f44ca43cd91df7179150005ca6f1da5","parkedReason":null,"artifactCount":1,"manifestHash":"fb3df278bacb09364956fac350c143b5aa73bbcd5fac3af52316ac59dfdc8ce6","attestationHash":"46540492626ca39652c62ad89de3ff6cbb36c742406bf33ff319cfac2f79fd2a","attestation":{"treeHash":"e2b9c59cb3750c43430f1e814e985e6dfb03bf2d","verifierVersion":"0.1.0+a6ee6548","verifierKey":"68249df1f422fa72f61ca7f0ddaf9b62043959c5c134498441d5e552a9921782","toolchain":{"solc":"0.8.26","forge":"forge Version: 1.8.3","viaIR":false,"optimizer":true,"evmVersion":"paris","bytecodeHash":"none","optimizerRuns":200},"contracts":[{"name":"BountyBox","path":"src/BountyBox.sol","abiHash":"61034414f397ffc00bf636b2d81e02559d7ee6b8c5b3955a23f1f0b037ddedca","opcodes":{"callcode":false,"delegatecall":false,"selfdestruct":false},"metadataHash":"0f5fd6a4c845cd770ec0f88640dfc13c73d2cb7a8678c9a02f50219fd16e01a4","creationCodeHash":"aac5d517f684b074cc9209fa831394c4ff7f7ddbb813ddf7ea5acc8c2f9ffa88","deployedCodeHash":"81b6c0c9de95824ae6694372bfc0d1d866ab57311b0702cf47ee521ee6817e14","creationCodeBytes":16818,"deployedCodeBytes":16507}],"manifest":{"kind":"evm_contracts","notes":"Deploy the accepted BountyBox application on Robinhood Chain (chain ID 4663). Constructor arguments are the specified platform reviewer EOA and the launch owner as explicit admin, avoiding the factory-as-admin fallback. The admin may propose, cancel and confirm oracle changes after a 24-hour delay, transfer administration through two-step acceptance, or renounce permanently. It has no pause, fund access, parameter-change or upgrade power. Each request retains its original oracle and a seven-day timeout with a 60% creator / 40% worker split. Deployment requires no ETH funding, initialization calls or additional contracts.","contracts":[{"contract":"BountyBox","constructorArgs":["0xEB3e371d6830d20353b15304217be669E02a3136","$owner"]}]},"manifestError":null},"attestationFailure":null,"deployFailure":null,"policyVersion":28,"economics":null,"poolFee":null,"requester":"0xa4453d4a445f288211f307a3b25531231e7c61cb","admissionChecks":[{"name":"provenance","detail":"8 node(s) accepted at fd99ae4b","status":"passed"},{"name":"findings","detail":"8 accepted submission(s), no unresolved blocking findings","status":"passed"},{"name":"independent_review","detail":"1 independent review(s)","status":"passed"},{"name":"bytecode","detail":"1 contract(s) clean and reproducible","status":"passed"},{"name":"manifest","detail":"1 application contracts; no protocol token or pool","status":"passed"},{"name":"protected_invariants","detail":"invariants-9c691c05ee3c: Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 591.67µs (421.27µs CPU time)","status":"passed"},{"name":"economics","detail":"policy explicitly selects no on-chain contributor rewards","status":"passed"}],"assurances":[],"logo":null,"seeded":null,"createdAt":"2026-10-18T22:15:19.136Z","updatedAt":"2026-10-18T22:15:50.587Z","jobs":[{"id":"64a6d18e-65f9-4a10-8b60-44d743fcfb32","objective":"UPDATE the existing \"Bounty Box\" build (IMD job: https://explorer.imdnotdead.fun/jobs/865f5b8b-7263-4943-be2b-50eeec478fcb). Keep its accepted src/BountyBox.sol and tests, and change only what is listed here. Contract only, no frontend work. Target chain: Robinhood Chain, set in one config file (chain ID, RPC, explorer). Do not deploy to Ethereum mainnet or Base. An older no-oracle version sits on Ethereum mainnet at 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775. Treat it as reference only; read its source if useful, but don't assume what it does.\n\nORACLE AND ADMIN (answers your open manifest question)\nConstructor(oracle_, admin_): oracle_ = 0xeb3e371d6830d20353b15304217be669e02a3136 (the platform reviewer EOA), nonzero, stored checksummed. If admin_ is the zero address, the admin is msg.sender (the deployer). Emit AdminSet(admin) in the constructor.\n- No production adapter, no request callback. escalate emits Escalated(jobId, submissionId, requestId). answer(requestId, ok, reviewSeconds, reason) is callable once per request, only by the oracle stored on that request. It reverts if the caller is the creator or a worker on that job. Keep the 24h to 7d clamp on reviewSeconds. Remove the IOracle interface.\n- The admin's ONLY power is changing the oracle. No pause, no fund access, no parameter changes, no upgrades.\n- Oracle change: proposeOracle(newOracle), then confirmOracle() after a 24h delay. The admin can cancel in between. newOracle must be nonzero. Emit events for propose, confirm and cancel.\n- Each request stores the oracle address that was current when it opened. Open requests are NOT reassigned; if their oracle is dead, they fall back to the 7-day 60/40 split as before.\n- Admin handover is two-step: transferAdmin(newAdmin), then newAdmin calls acceptAdmin(). The current admin can cancel before acceptance. renounceAdmin() sets admin to zero and permanently freezes the oracle.\n\nCONTRACT FIXES (from the audit findings)\n1. Mutual-silence lock: if a Pending submission is still unescalated 30 days after reviewUntil, anyone can close that slot as abandoned so the creator can refund. The worker keeps their escalate right until then.\n2. approve() works on any Pending submission after the 3-day window, until it's escalated. Only reject() stays time-limited.\n3. While a request is open, the creator may still approve a different, non-escalated submission. Finalizing cancels the escalated one.\n4. Cap deadline at 90 days from creation. settleAfter = request time + 7 days (drop the deadline term).\n5. Closed slots stop counting toward the 3-worker limit, so junk submitters can't block a job forever.\n6. refund() marks all live submissions Cancelled and emits the events, like the other end states.\n7. A creator approving their own second wallet can't be blocked onchain. Emit a distinct CancelledByApproval event for any live submission cancelled when another is approved.\n\nAdd a test for each fix and for every oracle/admin path (propose, confirm too early, cancel, non-admin calls, default admin = deployer, handover, renounce, a request answered only by its original oracle). Keep all 43 existing tests passing.\n\nDeliver: deploy-ready source, a deploy script for Robinhood Chain, and updated docs/ORACLE.md and docs/SECURITY.md. SECURITY.md must state that an admin exists, what it can and cannot do, and the 24h delay.","state":"completed","attachedAt":"2026-10-18T22:15:19.136Z"}],"artifacts":[{"role":"other","name":"BountyBox","address":"0x2b79cc53d7f0f6458c44ce4f78e8d9adb1393b19","creationCodeHash":"aac5d517f684b074cc9209fa831394c4ff7f7ddbb813ddf7ea5acc8c2f9ffa88","txHash":"0x231d887415a69557fe27872cd2ce70c06b2e9dde44cc8751ece7edff6fe29733","blockNumber":92116332,"verifiedAt":"2026-10-18T22:16:17.921Z","verifyFailure":null}],"allocations":[]}