How it worked
- Attackers. AI agents on Anthropic's Claude Fable 5.1, at its highest reasoning setting, each starting fresh with one area and one job: find a way to lose, steal, lock or misdirect money. They played the buyer, the seller, strangers, front-runners, a compromised attestor, and Yescrow's own servers and keys.
- No proof, no finding. A finding counted only with a passing test that shows the damage in token amounts, run on a copy of Arbitrum One with the real USDC, USDT0 and dispute court contracts. Ideas without a proof are listed separately.
- A second opinion on every finding. A fresh agent on Claude Opus 5.5, also at its highest setting, tried to refute each finding and ran its test again. It could rate a proven finding lower, with its reason shown next to the attacker's, but never drop it by argument.
- Fix, keep the test, attack again. Every finding was fixed in the next version, and its test kept so it fails if the weakness ever comes back: 485 of these tests pass today. The next run then attacked the fixed code.
The areas: money and the deal's states, signatures, the registry proofs, disputes and the dispute court, deposit addresses on other chains, the deployment, and our servers wherever they could make someone lose money.
What it found
No run found a Critical issue: no way to steal a party's money, pay a deal twice, or pay a seller on a proof of something the registry didn't say.
| Run | Found and fixed |
|---|---|
| Run 129 Oct 2026 | 1 High, 4 Medium, 7 LowSeven attackers, one per area, on v0.30. All fixed in v0.31.Read the report · Markdown, 241 KB |
| Run 229–31 Oct 2026 | 1 High, 3 Medium, 8 LowSeven attackers on v0.31, and every earlier finding's test run again. All fixed in v0.32.Read the report · Markdown, 166 KB |
| Run 31 Nov 2026 | 2 Medium, 7 LowFive attackers on what v0.32 changed, and every earlier finding's test run again. All fixed in v0.33.Read the report · Markdown, 159 KB |
| Run 41–2 Nov 2026 | 2 Medium, 5 LowFour attackers on what v0.33 changed, and every earlier finding's test run again. None of the findings was in the contracts; all were fixed in v0.34 (website, service and launch scripts).Read the report · Markdown, 123 KB |
| Run 56 Nov 2026 | 1 Low, 1 InfoOne attacker on the launch scripts, once the main network had its own keys, and every earlier finding's test run again. Nothing in the contracts; fixed in the launch scripts and our server's setup.Read the report · Markdown, 40 KB |
| Run 66 Nov 2026 | 2 Low, 1 InfoOne attacker on run 5's fixes. Nothing in the contracts; fixed in the launch scripts and our server tool.Read the report · Markdown, 47 KB |
| Run 76 Nov 2026 | 1 Low, 1 InfoOne attacker on run 6's fixes, and every earlier finding's test run again. Nothing in the contracts; fixed in the launch scripts and steps.Read the report · Markdown, 41 KB |
| Run 86 Nov 2026 | 1 Low, 4 InfoOne attacker on run 7's fixes, with a rule set before it ran: if nothing above Low turned up, its fixes would get tests and a rehearsal of the launch instead of another run. Nothing in the contracts; fixed in the launch scripts and our server tool.Read the report · Markdown, 75 KB |
| Run 96 Nov 2026 | 2 Medium, 2 Low, 1 InfoOne attacker on what changed in our servers and the signing dialogs since run 4, each finding checked again on our real server code. The two Mediums: a buyer could keep a seller whose court fee we pay from answering a dispute in time, and so could a server restart at the wrong moment. Nothing in the contracts; all fixed in v0.37 (servers and website).Read the report · Markdown, 85 KB |
| Run 106 Nov 2026 | Nothing foundOne attacker on run 9's fixes, on our real server code. Every fix held.Read the report · Markdown, 16 KB |
Both Highs were one weakness in the dispute court's appeals. After the jurors voted, the losing side could fund an appeal alone, and the court would then rule for it. Run 1's fix had our servers fund the other side; run 2 showed that fake cases could use up that budget first. Since v0.32 the contract itself ignores a one-sided appeal and pays what the jurors voted, and runs 3 and 4 found that this holds.
The contracts in use today are v0.33, the version run 4 attacked. Runs 5 to 8 attacked how they will be launched on the main network: the launch scripts, the keys they handle and the server they run on. Runs 9 and 10 attacked our servers and website where they pay the court's fee for a party and show what a party signs. None of these runs' findings was in the contracts. Each report has a summary, every finding with its second opinion, each attacker's full report including what it checked and found sound, and the prompts word for word. They are published unedited, apart from file paths on our server.
What it can't show
- It isn't independent. We ran it, and the code was written with Claude too. A reviewer that thinks like the author can share its blind spots. No outside firm, human auditor or other vendor's AI has reviewed the code.
- Nothing found isn't proof of no bugs. Each report lists what was checked and found sound, so you can see how deep it went. Nobody is accountable for what wasn't tried.
- The source repository is private. The reports point at files and tests in it. The contracts' source is verified on Arbiscan (the contracts), so you can check what the reports say about them.
- The contracts can't be patched. Nobody can change or pause them, us included. A flaw is fixed in a new version, and a deal stays on the version it was made on.
Found something?
Email teo@yescrow.xyz with “Security” in the subject, before telling anyone else. We answer within two working days. Please don't test against deals that aren't yours. Our contact details for researchers are also in security.txt.