Break It Before Users Do: MultiHopper Agentic Flow Bugs & Fixes

About the Bounty: Break It Before Users Do: MultiHopper Agentic Flow Bugs & Fixes

Superteam Earn listing draft | Bounty 1 of 2 | Responsible testing of the MultiHopper API in agentic workflows

Total Prize Pool

1,000 USDC

Prize Distribution

250 USDC - 1st | 250 USDC - 2nd | 250 USDC - 3rd | 250 USDC - 4th

Skills Needed

Development, Solana, AI Agents, Security / QA

About MultiHopper

MultiHopper is programmable multi-hop token routing infrastructure on Solana. It allows integrators to create scheduled, multi-hop token transfers through a REST API while on-chain programs and permissionless keepers handle execution.

For automated and agentic workflows, the API manages route creation, preparation, confirmation and monitoring, while signing and broadcasting remain client-side so private keys never leave the user environment.

Developer documentation: https://dev-docs.multihopper.com/

Agentic integration guide: https://dev-docs.multihopper.com/guides/agentic-integration

MCP documentation server: https://dev-docs.multihopper.com/mcp

 About the Campaign

We are opening the MultiHopper API to Solana developers and AI-agent builders before wider adoption. We want independent builders to use the documented agentic transfer flow, uncover real issues and suggest concrete fixes or improvements.

This is not a superficial review. We want reproducible findings that help make agent-driven on-chain routing safer, clearer and more reliable.

Your Mission

1. Review the MultiHopper API documentation and agentic integration guide.

2. Build or configure an automated workflow or AI agent that attempts a MultiHopper transfer using the approved test environment and credentials supplied for the bounty.

3. Test realistic execution paths and failure cases, with particular attention to signing, broadcast ordering, retries, idempotency, status monitoring and documentation usability.

4. Submit every valid issue with evidence, reproducible steps and a proposed fix or improvement.

Suggested Testing Areas

• Agent understanding of the documented create -> prepare -> sign/broadcast -> confirm-broadcast -> monitor flow.

• Client-side signing of prepared transaction bundles, including preservation of any existing server partial signatures.

• Strict broadcast sequencing: keeper funding first, followed by route initialization, orchestrator initialization and session initialization transactions.

• The two-step confirm-broadcast pattern and handling of missing keeper funding signatures.

• Idempotency-Key behavior, duplicate submissions, conflicting retries and clear error handling.

• Expiry and resume behavior after interrupted or partially completed broadcasts.

• Status polling, webhook-based monitoring, recovery paths and agent interpretation of failures.

• Documentation gaps, confusing instructions, unsafe assumptions or missing examples that materially block an agent integration.

Requirements

• Use only the test environment, API keys, wallets and token balances explicitly provided or approved by MultiHopper for this bounty. Do not test against mainnet or live user funds unless expressly authorized in writing.

• Your submission must concern MultiHopper API usage in an automated or agentic workflow. Generic UI feedback alone is not eligible.

• Provide a clear reproduction path: environment, request flow, relevant payloads with secrets removed, expected outcome, actual outcome and supporting evidence.

• Include a practical suggested fix, mitigation or documentation improvement for each reported issue.

• Never expose private keys, seed phrases, API keys or third-party secrets in the submission.

• Do not exploit, drain, spam, disrupt or publicly disclose a suspected issue before MultiHopper has reviewed it.

• Submissions must be in English.

• Submit the report in an accessible google doc/notion doc, etc

Submission Format

• Finding title and severity assessment: Critical / High / Medium / Low / Documentation blocker.

• What you built or used: agent framework, language, repository or private code access link, and relevant environment details.

• Steps to reproduce and affected API action or flow.

• Evidence: sanitized logs, screenshots, transaction signatures where applicable, and/or a short demo video.

• Impact on agentic usage or route reliability.

• Proposed fix, mitigation or improved documentation wording.

• A contact handle for follow-up.

Judging Criteria

• Impact: Does the finding meaningfully affect security, fund safety, reliable execution or successful agent adoption?

• Reproducibility: Can our team reproduce the issue quickly using your evidence and steps?

• Fix Quality: Is the proposed remediation practical, technically sound and clearly explained?

• Agentic Relevance: Does the issue expose a real failure mode for automated agents rather than a purely theoretical edge case?

• Communication Quality: Is the submission precise, responsible and easy for engineers to action?

Prize Allocation

Four submissions will each receive 250 USDC. Awards will be made to the highest-value validated findings based on the criteria above. Duplicate reports will generally be credited to the earliest complete and reproducible submission. MultiHopper may request reasonable verification before confirming an award.

Responsible Testing & Disclaimer

By submitting, you permit MultiHopper to reproduce your report internally and to contact you regarding remediation or further testing. MultiHopper may invite outstanding participants to join an ongoing private testing group or future paid bounty opportunities.

Testing must stay within the stated scope and approved environment. Any attempt to access unauthorized systems, compromise funds, disrupt service or disclose unremediated vulnerabilities publicly may disqualify the submission.