Help Validate the Security of GOAT’s Trust-Minimized Bitcoin Bridge
Bitcoin has earned its reputation as the world’s most secure blockchain through simplicity, transparency, and relentless public scrutiny. Any infrastructure built around Bitcoin should be held to the same standard.
Over the past year, the GOAT engineering team has been developing BitVM3, our implementation of a trust-minimized Bitcoin bridge designed to enable secure interoperability between Bitcoin and GOAT Network. Alongside protocol research, implementation, public documentation, formal verification, and continuous testnet iterations, we’ve focused on one objective above all else: building a bridge that prioritizes security.
Today, we’re launching the GOAT BitVM3 Bug Bounty Program—an initiative that invites independent security researchers, protocol engineers, smart contract auditors, cryptographers, and experienced blockchain developers to evaluate the GOAT BitVM3 Testnet, challenge its assumptions, and help strengthen the protocol before mainnet deployment.
A total reward pool of $5,000 USD has been allocated for accepted vulnerability reports submitted through this program. Rewards are determined based on the severity, technical impact, and reproducibility of each finding, with vulnerabilities assessed across Low, Medium, and Critical severity levels.
We believe that the strongest protocols are built through continuous review. Every issue discovered before mainnet is an opportunity to improve the security of the network before users rely on it.
Bitcoin Interoperability Is a Security Problem
Moving Bitcoin beyond its native chain has always required difficult engineering trade-offs.
Most existing bridges depend on additional trust assumptions—whether through custodians, multisignature committees, external validator sets, or federated operators. While these approaches have enabled interoperability across ecosystems, they have also become some of the largest attack surfaces in Web3. Over the past several years, bridge exploits have accounted for billions of dollars in losses, reinforcing a simple reality: bridge security is one of the hardest problems in blockchain infrastructure.
These trust assumptions exist for a reason: Bitcoin's scripting language cannot natively verify arbitrary off-chain computation, so bridges have historically substituted human or federated trust where cryptographic verification wasn't possible.
BitVM introduced a different direction.
Rather than requiring Bitcoin to execute arbitrary computation directly, BitVM allows computation to happen off-chain while preserving Bitcoin’s security model through optimistic verification and cryptographic dispute resolution. Instead of verifying every computation on-chain, Bitcoin only verifies disputed execution, dramatically reducing on-chain costs while maintaining strong security guarantees.
GOAT BitVM3 builds on these ideas with an implementation focused on production-ready Bitcoin interoperability. The protocol combines presigned transactions, one-time signatures, and SNARK-based dispute resolution, while introducing improvements such as stronger operator accountability and optimized reimbursement mechanisms designed to make the bridge both secure and practical to operate.
An Invitation to the Security Community
Security is strengthened through continuous review. Independent researchers bring fresh perspectives, specialized expertise, and the ability to uncover subtle vulnerabilities that internal testing, audits, and formal verification may not reveal on their own.
This program is an invitation to participate in that process.
Whether your background is smart contract security, protocol engineering, cryptography, distributed systems, or blockchain infrastructure, we encourage you to approach BitVM3 as an adversary would: challenge assumptions, explore edge cases, and identify vulnerabilities that could compromise the protocol’s security or correctness.
Every accepted report contributes directly to strengthening BitVM3 before mainnet.
Research Scope
The current Bug Bounty focuses on the GOAT BitVM3 Bridge and the components responsible for securing Bitcoin interoperability between Bitcoin and GOAT Network.
The current scope includes:
BitVM3 Bridge Protocol
Bridge Smart Contracts
Bridge State Machine (API)
Rather than focusing solely on individual components, we encourage researchers to evaluate how the system behaves as a whole.
This includes the complete bridge lifecycle—from bridge initiation and state transitions through proof generation, challenge execution, reimbursement flows, settlement, and withdrawal finalization. Interactions between protocol components are just as important as the correctness of each individual component.
Proof generation and dispute resolution in BitVM3 are powered by Ziren, ZKM's open-source zkVM. Researchers evaluating proof verification correctness are encouraged to review the Ziren repository as part of their analysis, and also to investigate vulnerabilities affecting:
Unauthorized withdrawal scenarios
Bridge state consistency
Challenge and dispute mechanisms
Smart contract implementation
Operator accountability
State machine behaviour
Algorithmic assumptions
Cross-component logic
Implementation vulnerabilities
If a vulnerability could compromise the security, correctness, availability, or reliability of BitVM3, we want to hear about it.
Rewards & Eligibility
GOAT Network has allocated a $5,000 USD reward pool for accepted vulnerability reports. Rewards will be determined based on the technical impact, severity, reproducibility, and overall value of each finding. Individual reward amounts and internal severity classifications will not be disclosed publicly.
The program is open to smart contract security researchers, blockchain security engineers, protocol engineers, cryptographers, auditors, bug bounty hunters, and experienced Web3 developers. Previous audit or bug bounty experience is valuable but not required—we also welcome researchers with strong technical backgrounds, open-source contributions, academic research, or demonstrated expertise in blockchain security.
The program is open to all security researchers and developers. Participants can begin testing immediately and submit valid vulnerability reports through GitHub or directly with this form. Reports will be reviewed by the GOAT engineering team, and eligible findings will be rewarded based on their severity, technical impact, and reproducibility.
Program Timeline
Program Timeline
Program Opens: August 18, 2026
Program Duration: 1 month
Reward Distribution: Following validation of accepted reports
Submitting a Vulnerability
If you discover a vulnerability, submit it through the GOAT Network GitHub repository. You may open a GitHub Issue describing the vulnerability or submit a Pull Request if you are also proposing a fix. GitHub timestamps will be used to determine priority when multiple researchers identify the same issue.
Researchers who prefer may also submit their findings through the official Bug Submission Form. Regardless of the submission method, reports should include:
Description of the vulnerability
Affected component(s)
Steps to reproduce
Proof of concept (if applicable)
Security impact
Bug Submission Form https://tally.so/r/EkGa02
Every submission will be reviewed by the GOAT engineering team. Accepted reports will be rewarded from the $5,000 USD reward pool based on the severity levels of critical, medium and low.
Suggested Research Areas
Proof verification
Bridge state transitions
Peg-in and peg-out flows
Challenge and dispute mechanisms
Smart contract implementation
State Machine (API)
Algorithmic correctness
Economic attack vectors
Out of Scope
UI or visual issues, documentation or typographical errors, social engineering attacks, third-party services, duplicate reports, and theoretical issues without practical security impact.
Technical Resources
GOAT BitVM3 User Guide:https://docs.goat.network/docs/users/goat-bitvm3-user-guide
GOAT BitVM Bridge Architecture: https://docs.goat.network/docs/network/bridge
GOAT BitVM Overview: https://docs.goat.network/docs/network/bitvm
Deferred Binding Research: https://hackmd.io/@goatresearch/HkKp2g1Zfl
BitVM3 Research Paper: https://bitvm.org/bitvm3.pdf
Contract Documentation: https://docs.goat.network/docs/build/contracts
Ziren zkVM: https://github.com/ProjectZKM/Ziren
Ready to Participate?
Apply to Participate: https://tally.so/r/44PM9O
Submit a Vulnerability: https://tally.so/r/EkGa02
