NEMETON OS — Card #001 · First Confirmed Bounty

CARD #001 — First Confirmed Bounty · Monk.io #286

Finding

WSL2 relay stuck after reboot — ECONNREFUSED 127.0.0.1:2137

Confirmed by

✓ nooga (Monk.io) — "Good find — this is confirmed"

GitHub issue

monk-io/monk-plugin #286 ↗

Bounty label

accepted · impact:medium · Accepted in Bug Bounty

Eligibility

✓ Complete — signed in + ran plugin · deadline Aug 31

Filed by seat

NyxSpecter4 (Captain) via Cursor

Ready to run

CISA / Program Feed — Real Finding In

Program

monk-io/monk-plugin — July 2026 Bug Bounty

Input

Issue #286 — ECONNREFUSED 127.0.0.1:2137 after WSL2 reboot

Validated

—

↓

Athelgard Scope Gate — Ethical Check

Check 1

Is this exploit/attack content? → No. Infrastructure connectivity bug.

Check 2

Live target accessed? → No. Local WSL2 environment only.

Check 3

Authorized program? → Yes. Official Monk.io bug bounty July 2026.

Result

—

↓

CWE Classification — Weakness Typed

Root cause

WSL2 localhost relay not recovered after distro restart. Port 2137 unreachable from Windows host.

CWE

—

Impact

—

↓

Hunt School — 6-Beat Lesson Generated

Beat 1

Recon: Identify WSL2 distro state with wsl -l -v — look for Stopped

Beat 2

Probe: netstat -an | findstr 2137 — confirm relay is absent

Beat 3

Reproduce: reboot → open extension → observe ECONNREFUSED

Beat 4

Root cause: monkd.service starts inside WSL but Windows relay is not rebuilt

Beat 5

Document: attach wsl-list.txt + netstat + curl evidence

Beat 6

Remediate: extension should auto-run wsl --shutdown + restart relay on ECONNREFUSED

↓

Cert Engine — Belt Issued

Impact

impact:medium — confirmed by program owner

Belt

—

Cert HMAC

—

↓

Evidence Passage — Report Draft

Finding

WSL2 localhost relay (127.0.0.1:2137) is not rebuilt after reboot. monkd.service starts inside the distro but the Windows-side port-forward is absent until wsl --shutdown recovery.

Evidence

wsl-list.txt (Stopped), netstat-stopped.txt (empty), curl-stopped.txt (ECONNREFUSED), monkd-journal.txt (service logs) — all attached to #286

Scope

Local WSL2 environment only — no external target accessed

↓

⛔ Human Gate — You Review the Draft

Action

Read the evidence above. Confirm it accurately represents what you found and reported to Monk.io.

↓

⛔ Human Gate — Confirm Nooga's Acceptance

Evidence

nooga commented: "Good find — this is confirmed." Label: accepted · impact:medium · Accepted in Bug Bounty. Eligibility: complete.

URL

github.com/monk-io/monk-plugin/issues/286 ↗

↓

✓ PRODUCT OUT — CARD #001 MAAT SEALED

Card ID

—

Program

monk-io/monk-plugin — July 2026 Bug Bounty

Issue

#286 — WSL2 relay stuck after reboot ↗

CWE

CWE-923 — Improper Restriction of Communication Channel

Impact

medium — confirmed by program owner

Belt earned

🥈 SILVER

Confirmed by

✓ nooga (Monk.io member) — "Good find — this is confirmed"

Eligibility

✓ Complete — signed in + ran plugin before Aug 31 12:00 UTC

Filed by

NyxSpecter4 (Captain) · seat:cursor → seat:bob

Stations passed

8 of 8 · 2 human gates cleared

MAAT seal

—

Timestamp

—

Status

✓ VERIFIED — Bounty receipt sealed. Points are yours.