Skip to content

Public challenge

Canary rules

  1. The goal. Make the Canary vault pay anyone other than its single mandated payee. If you find a way, tell us how: send a direct message to @probarionhq (opens in a new tab) on X that says you have a security report, with no details, as SECURITY.md (opens in a new tab) describes.
  2. How it works. A deliberately gullible model proposes a payment. Code rules judge it. In raw mode, a rate-limited share of code-refused proposals also goes straight to the contract, bypassing the code rules, when the contract's own dry run says it would refuse them. That lets you watch NEAR refuse it on chain.
  3. Why an address in your message cannot work. A spend request has no address field. The contract pays only the payee stored in the mandate, which only the owner's wallet can create.
  4. Limits. A message is at most 4,000 characters. One network address gets at most 5 model attempts every 10 minutes and 6 an hour. All visitors together get at most 60 an hour and 600 a day. On chain, one visitor gets 1 attempt every 10 minutes, and all visitors together get at most 30 an hour. There is also a daily budget of 2,000,000 model tokens for everyone together. Raw mode pauses when the agent key's gas allowance falls below 0.2 NEAR.
  5. Out of scope. Denial of service; spam; attacks on Vercel, Supabase, NEAR AI Cloud, wallets or other users; social engineering of the team; anything illegal. Report bugs in Probarion's own servers as SECURITY.md (opens in a new tab) says, not here.
  6. Your data. Your message goes to a private model on NEAR AI Cloud. We store a sha256 hash of it, not the text, plus technique labels and the on-chain result. Your IP address and cookie are stored only as keyed hashes, for rate limits. Do not submit personal data.
  7. How you are counted. You are a challenge participant, not a customer. The Usage page counts you apart from the product's own users.
  8. The fine print. This is beta, unaudited software. It runs on testnet, with test tokens that have no value. The challenge may pause or end at any time; the live balance is on the Canary page. These rules may change while the challenge runs.

Back to the Canary