Foundation inspection request — Cantina bounty mediation policy enforcement (finding #784, 29-day stalled dispute)

Requests for Comment
1

This is a procedural inspection request to the Uniswap Foundation, in its capacity as the funder-of-record of the $15.5M Uniswap Labs bug bounty program operated by Cantina (docs.cantina.xyz).

I am a security researcher Voltgzer0 . I submitted a Critical-severity finding to the Uniswap Labs bounty on 2026-06-05 (finding #784, ContinuousClearingAuction). The finding was rejected the same day by the client representative acting in the Cantina interface. I filed a dispute the same day. That dispute has been sitting in the Cantina platform for 29 days without any Step-4 triage activity, without any assigned reviewer, and without any response.

I am not asking the Foundation to adjudicate technical merits. I am asking the Foundation, on the record, to inspect a specific structural question:

Does Cantina’s published mediation process, as it is currently operating for the Uniswap Labs bounty, satisfy the standard the Foundation was contemplating when the $15.5M program was authorized via UNIfication?

The public GitHub record (independently reproducible in under 60 seconds by appending .patch to any commit URL and by hitting the /pulls/N/reviews GitHub REST endpoint) establishes:

  1. The party who rejected #784 authored 246 pull requests and 58 issues in the target repository — a structural conflict of interest under standard COI scoring.

  2. On the day of the rejection (2026-06-05), the same party pushed five commits to the exact file under review (src/ContinuousClearingAuction.sol) within a 35-minute window (14:59:55 UTC through 15:35:11 UTC). Commit hashes: 8d974910, bb88311b, ab531ab5, 22ad9a70, 4e89d25f.

  3. The “fix” cited in the rejection (forceIterateOverTicks) was, at the moment of the rejection, still an unmerged PR under review (PR #355). The rejecting party had approved that PR on 2026-06-02T20:10:08Z, approved it again on 2026-06-08T19:36:39Z, and is Co-authored-by on the merge commit (02e5438e, 2026-06-10T14:10:37Z). All timestamps from GitHub REST /pulls/355/reviews field submitted_at.

  4. The post-rejection v2.0.0 release (tag aee9bca5, 2026-06-16) still ships src/ContinuousClearingAuction.sol with the verbatim OOG-comment line (“This can revert with out of gas if there are a large number of ticks”) and the verbatim onlyActiveAuction / onlyAfterAuctionIsOver mutual-exclusivity that renders the cited fix mechanically unreachable from the exitBid() path.

Cantina’s own published mediation process (docs.cantina.xyz/cantina-docs/cantina-bounties/mediation-process-for-bounties) does not name a mediation team, does not commit to any SLA, does not describe any external oversight body, and ends with “Cantina’s decision is final.” There is no operational contact endpoint for mediation.

I filed a formal mediation request to Cantina Support on 2026-06-24 (Ticket #251995). Support replied on 2026-06-25 that they cannot adjudicate individual findings via support email and would route the request through Cantina’s internal review processes. I filed a documented follow-up on 2026-06-29 including the GitHub timeline evidence. Cantina has issued no case reference number, no routing confirmation, and no substantive response in 10 days.

The Foundation has precedent for enforcing terms on Spearbit — the Cork Protocol post-mortem (May 2025) established that Foundation grant terms require open-sourcing of audits within 15 business days, a term Spearbit was publicly reminded of.

Canonical procedural record (all facts + reproduction commands): https://gist.github.com/voltgzer0/4ee393994c5a0f6a64ea24bd0930f791

I specifically request:

A. That the Foundation make procedural inquiry to Cantina regarding whether Step 4 of the published mediation process was performed for #784.

B. That the Foundation clarify whether the researcher-side COI rule (“You cannot be … a vendor or contractor who has been involved in the development of the code of the bug in question”) is expected to have a symmetric counterpart for triagers and client representatives acting as decision-makers in the Cantina interface, and, if so, how it should be enforced.

C. That the Foundation confirm whether the bounty program funded via UNIfication is subject to any Foundation-side oversight when the platform-side mediation process (“Cantina’s decision is final”) stalls indefinitely.

I am not asking the Foundation to reverse Cantina’s determination. I am asking the Foundation to confirm what its own posture is when the process it authorized appears to not be executing.

Full context is on request — I am withholding technical detail on #784 itself in compliance with Cantina’s non-disclosure clause during mediation.

Thank you.

— voltgzer0

2 Likes