Submit your protocol to MegaLenz

Attest to each v0.5 scoring check and link your evidence — or upload a team-submission/v1 JSON file. We take your attestations as the draft, run an on-chain proof to corroborate, and open a draft PR for curator review. Coverage is capped at Medium and every check is marked inferred until independently verified.

Submit by JSON (advanced)

Upload or paste a team-submission/v1 object. We validate it and hydrate the form below so you can review before submitting — the invite code and anti-spam check stay on the form.

Drag & drop a .json file here, or
Don't have an invite code? Contact the curator at mail@petranto.com to request one.
Attest to each check below. Default is unknown; a pass needs at least one evidence URL. Open “what counts” for the full rubric text.
Governance0/4 pass
gov.decentralized-adminDecentralized admin / upgrade / pause roles
what counts

All admin / upgrade / pause roles held by decentralized governance — multisig (n-of-m, n >= 2), on-chain DAO with quorum vote, or equivalent multi-party structure. Single-key control (EOA, 1-of-N multisig) fails.

gov.timelockTimelock on upgrades & parameter changes
what counts

Non-zero timelock delay enforced on upgrades and parameter changes.

gov.contract-ownershipOwnership held by a contract (not an EOA)
what counts

Ownership held by a contract (Safe, DAO module, etc.) — not an EOA.

gov.public-processPublic governance process reachable
what counts

Public governance process — forum, proposal queue, or on-chain vote — reachable.

Security Signals0/4 pass
sec.public-auditsPublic, dated, scoped audit reports
what counts

Public audit reports linked, dated, and scoped to the deployed code. A generic "we were audited by X" without a report URL doesn't count. Re-audit on each major upgrade.

sec.bug-bountyActive bug bounty with a published payout tier
what counts

Active bug bounty program — Immunefi, HackerOne, or similar — with a current published payout tier visible on the program page. Self-hosted "email security@" without payout tiers doesn't count.

sec.incident-disclosureIncident disclosure / documented no-incident policy
what counts

Incident disclosure history — either a public post-mortem for any past incident, or a documented "no incidents" status with a security contact and disclosure policy. Silence does not count; explicit communication is required.

sec.source-verifiedSource matches deployed bytecode
what counts

Source code public and matches deployed bytecode — verified on the explorer for all in-scope contracts. Same fact as the first Transparency check, but graded here for a different reason: this confirms the audited code is what's running.

Transparency0/4 pass
trans.contracts-verifiedAll in-scope contracts source-verified
what counts

All contracts in scope are source-verified (bytecode matches published source).

trans.audit-linkedAt least one public, dated audit linked
what counts

At least one public, dated audit report linked. Re-audit on each major upgrade.

trans.docs-match-onchainDocs cover deployed scope; addresses match on-chain
what counts

Public docs cover the deployed scope (addresses in docs match on-chain).

trans.disclosuresDisclosures present (incident log / contact)
what counts

Disclosures present — incident log, post-mortems, or a security contact.

MegaETH0/3 pass
mega.native-deploymentNative MegaETH deployment (no critical bridge dep.)
what counts

Native MegaETH deployment — no critical dependency on a bridge that, if halted, would freeze the protocol.

mega.slot-awareAware of MegaETH 2ms slot finality
what counts

Code is aware of MegaETH's 2ms slot finality (no buggy timing assumptions copied from L1).

mega.mev-policyMEV / ordering policy documented
what counts

MEV / ordering policy explicitly documented; no implicit reliance on private mempools.

Anti-spam check