540 Reports In, 34 Bugs Confirmed: Inside TipRun's Pre-Launch Security Sweep

HackenProof Ecosystem

2 Minutes ReadPublished: 27 Oct 2026

540 Reports In, 34 Bugs Confirmed: Inside TipRun's Pre-Launch Security Sweep

A 20-day HackenProof audit contest on TipRun's Solidity smart contracts surfaced 34 valid findings—8 critical, 8 high, 5 medium, and 13 low—out of 540 total submissions, all resolved before the platform's peer-to-peer cricket prediction markets went live.

Client—TipRun

Industry—Prediction Markets

Program Type—Audit Contest

Scope—Smart Contract (Solidity)

01—Case Overview

TipRun - tiprun.fun

TipRun is the world’s first peer-to-peer cricket prediction exchange. On TipRun, you trade directly with other users, in contrast to the traditional sportsbook where you play against the house. Buyers are matched with the sellers, and the market sets the prices—not a bookmaker.

HackenProof ran an audit contest from June 5th to June 24th, 2026, inviting its community of security researchers to probe TipRun’s smart contracts using both automated and manual analysis techniques. The TipRun team triaged and resolved all 34 valid findings.

TOTAL VALID FINDINGS—34

Valid reports found: 8 critical, 8 high, 5 medium, plus low findings

TOTAL REWARDS PAID—$15.000

Total bounty paid to researchers across all severity categories

CONTEST DURATION—20 days

Duration of the audit contest: June 5th to June 24th, 2026

CRITICAL SEVERITY BUGS—8

Critical-severity findings: zero-collateral synthetic minting, deleverage signature bypass, uncollateralized short draining the market

02—CHALLENGES

TipRun's biggest exposure wasn't one bug class—it was the combination of a novel product model with dense financial engineering

Novel financial engineering surface

TipRun combines peer-to-peer prediction market mechanics with perpetual-style margin, funding, and liquidation logic—a combination with few prior audited references. Interactions between the order book, risk engine, and collateral accounting created edge cases that unit tests alone could not surface.

Oracle price integrity

Multiple findings—stale price consumption, price replay/rollback, and a median calculation flaw enabling systematic price inflation—showed that oracle freshness and validation needed dedicated adversarial review beyond standard integration testing.

Cross-margin and funding accounting complexity

Several critical and high findings involved funding index calculations and cross-margin bucket accounting (partial funding applied per-asset while margin summed the whole bucket, funding settlement not value-conserving under split positions). These are subtle value-conservation bugs that only appear under specific, adversarial parameter combinations.

Admin and signer privilege boundaries

A self-minted admin privilege bug and a deleverage flow that accepted named signers without verifying signatures both point to the same root issue: access control assumptions that held under normal testing broke under adversarial conditions—critical to catch before real user funds were at risk.

03—HOW IT WORKED

HackenProof ran the contest end-to-end—from researcher activation through triage and reward distribution—freeing TipRun’s engineers to focus on remediation.

01—Contest setup on Solidity-specialized scope

The full TipRun smart contract suite on Solidity was defined as scope, with a $15,000 bounty pool structured across severity tiers (65% critical, 20% high, 10% medium, 5% low)

02—Community researcher activation

HackenProof activated researchers with Solidity protocol expertise—both through automated analysis and manual adversarial review.

03—Findings across severity spectrum

Researchers identified 8 critical-severity issues (zero-collateral synthetic minting, deleverage signature bypass, uncollateralized short draining the market), 8 high issues (oracle price replay, self-minted admin privilege), and further medium/low findings.

04—In-house triage by HackenProof

All incoming reports were reviewed before reaching TipRun—ensuring the team received only validated, severity-classified findings with reproduction steps.

05—$15,000 distributed, all issues resolved

TipRun resolved all findings before launch; $15,000 was paid out proportionally—8 critical issues were found, so the 65% critical allocation was distributed in full.

04—RESULTS

CRITICAL SEVERITY—8

Critical severity findings: zero-collateral synthetic minting, deleverage signature bypass, uncollateralized short draining the market

HIGH SEVERITY—8

High severity findings: oracle price replay, self-minted admin privilege

MEDIUM SEVERITY—5

Medium severity findings: permanent settlement freeze, unbounded per-account market, zero-amount pre-registration

TOTAL BOUNTIES—$15,000

Total paid to researchers—split across critical, high, medium, and low severity categories

FINDINGS BY SEVERITY

Critical—8

High—8

Medium—5

Low—13