Docs

Security model

What the program guarantees, and the trust assumptions that remain.

Guarantees enforced by the program

Sponsor-only actions: approve, reject and reclaim require the signer to be bounty.sponsor (has_one, error Unauthorized).
No double payment: a submission can only be approved while Pending, and approval flips it to Approved in the same instruction.
Max winners: approvals fail once paid_count == max_winners.
Always funded: the vault holds reward × max_winners from creation, using checked multiplication.
Vault custody: the vault's authority is the Bounty PDA, so only the program can move funds, and only along the approve and reclaim paths.
Account validation: PDA seeds and bumps are verified on every instruction; the submission must belong to the bounty and creator passed in.
Reclaim safety: the bounty is marked Closed before funds move, so it cannot be reclaimed twice.
One entry per creator: enforced by the submission PDA.

The program has 22 passing tests covering the happy path, authorization failures, limits and edge cases.

The sponsor is the judge. Munera does not arbitrate: a sponsor can reject any submission, or reclaim after the deadline without reviewing. Escrow protects creators from an empty promise, not from an unfair judge. Sponsor history is public, and creator reputation is on the roadmap.
Links are not verified. The program stores the submitted URL; it does not check that it resolves or who owns it.
Devnet only. The program has not been audited and must not hold real funds until it has been.
Upgradeable program. On devnet the upgrade authority is the deployer wallet. A mainnet deployment would use a multisig or an immutable program.

Found a bug? Open an issue on GitHub or message @munera_xyz.