How it worked
- Attackers. AI agents on Anthropic's Claude Fable 5.1, at its highest reasoning setting, each starting fresh with one area and one job: find a way to lose, steal, lock or misdirect money. They played the buyer, the seller, strangers, front-runners, a compromised attestor, and yescrow's own servers and keys.
- No proof, no finding. A finding counted only with a passing test that shows the damage in token amounts, run on a copy of Arbitrum One with the real USDC, USDT0 and Kleros contracts. Ideas without a proof are listed separately.
- A second opinion on every finding. A fresh agent on Claude Opus 5.5, also at its highest setting, tried to refute each finding and ran its test again. It could rate a proven finding lower, with its reason shown next to the attacker's, but never drop it by argument.
- Fix, keep the test, attack again. Every finding was fixed in the next version, and its test kept so it fails if the weakness ever comes back: 469 of these tests pass today. The next run then attacked the fixed code.
The areas: money and the deal's states, signatures, the registry proofs, disputes and Kleros, deposit addresses on other chains, the deployment, and our servers wherever they could make someone lose money.
What it found
No run found a Critical issue: no way to steal a party's money, pay a deal twice, or pay a seller on a proof of something the registry didn't say.
| Run | Found and fixed |
|---|---|
| Run 129 Oct 2026 | 1 High, 4 Medium, 7 LowSeven attackers, one per area, on v0.30. All fixed in v0.31.Read the report · Markdown, 241 KB |
| Run 229–31 Oct 2026 | 1 High, 3 Medium, 8 LowSeven attackers on v0.31, and every earlier finding's test run again. All fixed in v0.32.Read the report · Markdown, 166 KB |
| Run 31 Nov 2026 | 2 Medium, 7 LowFive attackers on what v0.32 changed, and every earlier finding's test run again. All fixed in v0.33.Read the report · Markdown, 159 KB |
| Run 41–2 Nov 2026 | 2 Medium, 5 LowFour attackers on what v0.33 changed, and every earlier finding's test run again. None of the findings was in the contracts; all were fixed in v0.34 (website, service and launch scripts).Read the report · Markdown, 123 KB |
Both Highs were one weakness in Kleros appeals. After the jurors voted, the losing side could fund an appeal alone, and Kleros would then rule for it. Run 1's fix had our servers fund the other side; run 2 showed that fake cases could use up that budget first. Since v0.32 the contract itself ignores a one-sided appeal and pays what the jurors voted, and runs 3 and 4 found that this holds.
The contracts in use today are v0.33, the version run 4 attacked. Each report has a summary, every finding with its second opinion, each attacker's full report including what it checked and found sound, and the prompts word for word. They are published unedited, apart from file paths on our server.
What it can't show
- It isn't independent. We ran it, and the code was written with Claude too. A reviewer that thinks like the author can share its blind spots. No outside firm, human auditor or other vendor's AI has reviewed the code.
- Nothing found isn't proof of no bugs. Each report lists what was checked and found sound, so you can see how deep it went. Nobody is accountable for what wasn't tried.
- The source repository is private. The reports point at files and tests in it. The contracts' source is verified on Arbiscan (the contracts), so you can check what the reports say about them.
- The contracts can't be patched. Nobody can change or pause them, us included. A flaw is fixed in a new version, and a deal stays on the version it was made on.
Found something?
Email hello@yescrow.xyz with “Security” in the subject, before telling anyone else. We answer within two working days. Please don't test against deals that aren't yours. Our contact details for researchers are also in security.txt.