Audit Competition | ENS-logo

Audit Competition | ENS

|

ENS (Ethereum Name Service) is a distributed, open, and extensible naming system based on the Ethereum blockchain. ENS maps human-readable names like 'alice.eth' to machine-readable identifiers such as Ethereum addresses, other cryptocurrency addresses, content hashes, and metadata. It functions as a decentralized alternative to the traditional DNS, allowing users to replace long, complex wallet addresses with simple, memorable names.

Built on a system of smart contracts, ENS supports both the '.eth' top-level domain native to Ethereum and the integration of traditional DNS names. Its architecture is composed of two principal components: the registry, which maintains the record of all domains and their owners, and resolvers, which are responsible for translating names into the corresponding addresses or resources.

Live

20d: 17h remaining
Primary Pool
$49,000
All Stars Pool
$14,000
Podium Pool
$7,000
Vault TVL
$69,989.64
Start Date
18 August 2026
End Date
14 September 2026
Rewards Token
USDC
Lines of Code
137,845
  • Triaged by Immunefi

  • Step-by-step PoC Required

  • Vault program

  • KYC required

Documentation

Title
ENS documentation
Description
The place to start
Link
Title
Contracts for ENSv2
Description
-
Link
Go to Audits & Known Issues
Assets Body

Build Commands, Test Commands, and How to Run Them

Prerequisites

  • Node: v22
  • pnpm: v10 (pinned in packageManager; run corepack enable)
  • Docker: Required for end-to-end (E2E) suites only

Setup

pnpm install --frozen-lockfile

Audited revision โ€” commit hash: 63772fd872af472ced58b009499355f3430c2a86


Environment Variables

โš™๏ธ Manager App (apps/manager)

Add to apps/manager/.env.local:

VITE_RHINESTONE_API_KEY=rs_FWMNwSvBEEhsk6jWi46yUUO50fC65fOe1lVSnDsls4

VITE_TELEGRAM_BOT_ID โ€” optional; only used by the Telegram notification-channel login. The app runs fine without it. Telegram login widgets only work from the domain registered with the bot, so to exercise this flow locally, create your own bot with Telegram's @BotFather, register your local domain with it, and set this variable to your bot's numeric ID.

๐Ÿงญ Explorer App (apps/portal)

No configuration needed; the committed defaults use public endpoints.


Application Commands

๐Ÿงญ Explorer App (apps/portal)

Server: Runs on http://localhost:3001 Config: Runs with no configuration; all defaults use public endpoints.

pnpm --filter portal dev      # Start dev server
pnpm build:portal             # Build (also typechecks)
pnpm typecheck:portal         # Typecheck only
pnpm test:portal              # Unit tests
pnpm test:portal:cov          # Unit tests with coverage

โš™๏ธ Manager App (apps/manager)

Server: Runs on http://localhost:3000 Config: Configuration values are supplied with the test environment (see Environment Variables above).

pnpm dev:manager              # Start dev server
pnpm build:manager            # Build
pnpm typecheck:manager        # Typecheck
pnpm test:manager             # Unit tests
pnpm test:manager:cov         # Unit tests with coverage
# Optional: Run Storybook on :6006
pnpm --filter manager storybook:dev

End-to-End Tests (Playwright)

Requirement: Docker must be running locally.

pnpm e2e:infra:up             # Start local chain and services
pnpm e2e:manager              # Run Manager suite
pnpm e2e:portal               # Run Explorer suite
pnpm e2e:cross-app            # Run cross-app suite
pnpm e2e:infra:down           # Tear down local chain and services

Repo-Wide Commands

pnpm test:all                 # Run tests across all packages
pnpm check                    # Run lint and format checks

๐Ÿ’ก Tip: Running a bare pnpm test at the root executes Explorer tests only. Scripts can also be run directly inside an app's directory (e.g., cd apps/portal && pnpm dev).


Test Coverage Summary

All test suites pass on a clean checkout.

ApplicationTest FilesTestsStatementsBranchesFunctionsLines
Manager (apps/manager)1621,39179.5%69.3%72.3%80.5%
Explorer (apps/portal)1301,32175.8%72.5%66.0%76.4%
Total2922,712โ€”โ€”โ€”โ€”

E2E Coverage Details: Includes 11 Playwright specs across three projects (Manager, Explorer, and cross-app). Tests cover registration, migration, profile edits, primary names, notifications, and temporary premium status running against a Dockerised local chain.

Previous Audits

ENS's relevant internal-audit findings are disclosed in the Known Issues section. Unfixed vulnerabilities mentioned there are not eligible for a reward.

Audit Competition | ENS Bug Bounties | Immunefi