Rain USDR Smart Contract Audit Contest, September 2026
Rain is running a live smart contract audit contest on HackenProof with bounties from $0 to $14,000. The contest ends 1 October 2026.
The Rain USDR Smart Contract Audit Contest on HackenProof is live. Rain describes the project as a prediction markets protocol. The contest started on 14 September 2026 and ends on 1 October 2026. The bounty range is $0 to $14,000. Severity bands listed on the page go up to $5,600 for critical, $4,200 for high, $2,100 for medium, and $700 for low. There is a $5 submission fee. KYC and a proof of concept are required.
In scope is the /contracts tree of the listed Rain USDR contracts repository. Tests, mocks, deploy scripts, third party libraries, and documentation are out of scope. Accepted impacts include theft or freezing of funds, insolvency, governance vote manipulation, griefing, unbounded gas, and some correctness issues even when user funds are not lost. Oracle data errors, basic 51 percent attacks, lack of liquidity, sybil attacks, and frontend bugs that do not compromise the contracts are out of scope.
Reports go through HackenProof. Researchers must not test against third party oracles or public infrastructure, and must not disclose findings outside HackenProof or Rain until the organiser agrees. Duplicate reports can still be rewarded. Access to the code is through a Discord support ticket, with KYC required for that access.
The program page marks the contest as live and active. It does not say the contest has closed.