20 of 20 attacks refused
Each row is a real transaction sent from a real account to the compiled contract on a near-workspaces 0.24, local neard sandbox chain by contract/tests/attacks.rs. "Refused" means the chain rejected it with the message shown, or for a forged reveal, that the bid was not counted. Nothing here is mocked; it is not testnet or mainnet either.
| # | Attack | What we sent | Chain's answer | Result |
|---|---|---|---|---|
| 1 | Take over an existing agent | register_agent with a name already in use | agent exists | refused |
| 2 | Post a job with a dust bounty | post_job with 0.01 NEAR | bounty must be at least 0.5 NEAR | refused |
| 3 | Bid in someone else's name | mallory calls commit_bid for ledger | only the agent or operator | refused |
| 4 | Unfunded agent bids | agent balance drained below the 0.01 NEAR inference reserve, then commit_bid | agent balance below inference reserve | refused |
| 5 | Reveal early to signal a price | reveal_bid during the commit window | not in reveal window | refused |
| 6 | Drain an agent through fake inference bills | mallory calls charge_inference | only operator | refused |
| 7 | Late bid | commit_bid after the commit window | commit window closed | refused |
| 8 | Change the price after sealing | reveal_bid with a lower price than committed | reveal does not match the commitment; bid not counted | refused |
| 9 | Reveal with a guessed salt | reveal_bid with the right price and a wrong salt | reveal does not match the commitment; bid not counted | refused |
| 10 | Reveal twice | second reveal_bid for the same commitment | already revealed | refused |
| 11 | Close the auction early | close_auction during the reveal window | reveal window still open | refused |
| 12 | Fake reviewer approves | mallory calls submit_review | only reviewer | refused |
| 13 | Fake reviewer rejects a winner | mallory calls reassign | only reviewer | refused |
| 14 | Double payout | reviewer submits the same review twice | job not assigned | refused |
| 15 | Run with the bond | withdraw_backing of all shares while the bond is locked | funds are bonded on recent work; wait for the challenge window | refused |
| 16 | Withdraw another backer's money | mallory calls withdraw_backing with no shares | not enough shares | refused |
| 17 | Challenge without a deposit | challenge with no NEAR attached | attach exactly 0.1 NEAR | refused |
| 18 | Challenger slashes the agent itself | mallory calls resolve_challenge on her own challenge | only reviewer | refused |
| 19 | Release a challenged bond | release_bond while a challenge is open | challenge pending | refused |
| 20 | Overwrite a pre-registration | preregister an existing hash | already registered | refused |
Run it yourself: cd contract && cargo near build non-reproducible-wasm && cargo test --test attacks -- --nocapture.