Autonolas-logo

Autonolas

Olas (formerly Autonolas) is a protocol for creating, running and co-owning autonomous AI services, secured by the OLAS token and a multi-chain on-chain protocol. This bug bounty covers the Olas on-chain protocol — the Solidity smart contracts spanning service registries, tokenomics, governance, and the marketplace deployed across Ethereum and 7 additional chains. The scope reflects the contract set reviewed in the Code4rena 2026-01 audit, including the OLAS token, veOLAS, cross-chain governance, the staking infrastructure, and the reward, bonding and protocol-owned-liquidity mechanisms.

ETH
Base
Celo
Gnosis
Optimism
Polygon
Arbitrum
Mode
Infrastructure
DAO
Services
Token
Staking
Oracle
Solidity
Maximum Bounty
$5,000
Live Since
10 August 2022
Last Updated
05 June 2026
  • PoC Required

  • KYC required

Codebase

Title
Olas Tokenomics — autonolas-tokenomics
Description
Tokenomics engine and incentive contracts: the Tokenomics proxy/implementation, Treasury, Depository and GenericBondCalculator (bonding), the Dispenser with L1 deposit processors and L2 target dispensers, the TWAP price oracles, the BuyBackBurner and Bridge2Burner contracts, and the protocol-owned-liquidity LiquidityManager contracts. In-scope code is the contracts/ directory at the pinned tag (post-Code4rena-2026-01 state).
Link
Title
Olas Registries — autonolas-registries
Description
On-chain component / agent / service registries and the Olas staking infrastructure: the ERC-721 registries, ServiceManager, multisig and recovery-module helpers, StakingFactory / StakingVerifier / StakingToken, and the ERC-8004 IdentityRegistryBridger. In-scope code is the contracts/ directory at the pinned tag (post-Code4rena-2026-01 state).
Link
Title
Olas Governance — autonolas-governance
Description
On-chain governance and token contracts: the OLAS token, the veOLAS / wveOLAS voting-escrow tokens, GovernorOLAS with Timelock, the VoteWeighting gauge controller, the GuardCM community-multisig guard and its bridge payload verifiers, the L1 OLAS Burner, and the cross-chain governance bridge mediators. In-scope code is the contracts/ directory at the pinned tag (post-Code4rena-2026-01 state).
Link
Title
Olas Marketplace — autonolas-marketplace
Description
Mech Marketplace contracts: MechMarketplace and KarmaProxy with their implementations, the mech base contracts (OlasMech, MechFixedPriceBase) and per-payment-type mechs (FixedPriceNative, FixedPriceToken, NvmSubscriptionNative), and the corresponding MechFactory and BalanceTracker contracts. In-scope code is contracts/ at the pinned tag (post-Cantina-2025-02 audit + subsequent internal audits). The SubscriptionProvider contract is excluded from this program. Inherited code from Solmate and the Gnosis Mech base contract (gnosis-mech) is in scope where it is incorporated into Olas's own contracts.
Link

Documentation

Title
autonolas-tokenomics — README
Description
Repository overview of the tokenomics, bonding, dispensing and POL contracts, with links to the flowchart, tokenomics model and audits.
Link
Title
autonolas-registries — README
Description
Repository overview of the component/agent/service registries and staking contracts, with links to the flowchart, FSM, definitions and audits.
Link
Title
autonolas-governance — README
Description
Repository overview indexing all governance/token contracts, architecture flowchart, specs, audits and the known-issues list.
Link
Title
Protocol-wide
Description
- Olas Tokenomics — Core Technical Document — https://olas.network/documents/whitepaper/Autonolas_Tokenomics_Core_Technical_Document.pdf — Whitepaper of the Olas tokenomics model: epochs, developer rewards, the IDF for bonding, and staking emissions. - Proof of Active Agreement (PoAA) Staking Whitepaper — https://staking.olas.network/poaa-whitepaper.pdf — Whitepaper of the Olas staking mechanism implemented by the registries staking contracts and the tokenomics Dispenser.
Link
Title
Marketplace
Description
- autonolas-marketplace — README — https://github.com/valory-xyz/autonolas-marketplace/blob/main/README.md — Repository overview of the Mech Marketplace contracts, with the architecture flowchart of mech registration, request routing, balance tracking and karma accounting. - Mech Marketplace description and contracts overview — https://github.com/valory-xyz/autonolas-marketplace/blob/main/docs/MechMarketplaceDescriptionAndContractsOverviewRepo.pdf — Design document covering the marketplace workflow, the roles and interactions of mechs, requesters, factories and balance trackers, and the smart-contract layout.
Link
Go to Audits & Known Issues
Assets Body

Many in-scope contracts are deployed on multiple chains. For those, the Assets table lists one representative deployment address per contract, with the remaining per-chain addresses given in that asset's description — all listed deployments are in scope.