diff --git a/contracts/bounties/SimpleTokenBounty.sol b/contracts/bounties/SimpleTokenBounty.sol
index 42b65eb36..6721186a4 100644
--- a/contracts/bounties/SimpleTokenBounty.sol
+++ b/contracts/bounties/SimpleTokenBounty.sol
@@ -8,6 +8,10 @@ import '../PullPayment.sol';
  * have sufficient ether for everyone to withdraw.
  */
 
+contract Factory {
+  function deployContract() returns (address);
+}
+
 contract Target {
   function checkInvariant() returns(bool);
 }
@@ -21,8 +25,8 @@ contract Bounty is PullPayment {
     if (claimed) throw;
   }
 
-  function createTarget(address targetAddress) returns(Target) {
-    target = Target(targetAddress);
+  function createTarget(address factoryAddress) returns(Target) {
+    target = Target(Factory(factoryAddress).deployContract());
     researchers[target] = msg.sender;
     return target;
   }
diff --git a/contracts/test-helpers/InsecureTargetMock.sol b/contracts/test-helpers/InsecureTargetMock.sol
index 2918361a8..8b85b6eb9 100644
--- a/contracts/test-helpers/InsecureTargetMock.sol
+++ b/contracts/test-helpers/InsecureTargetMock.sol
@@ -5,3 +5,9 @@ contract InsecureTargetMock {
     return false;
   }
 }
+
+contract Deployer {
+  function deployContract() returns (address) {
+    return new InsecureTargetMock();
+  }
+}
diff --git a/contracts/test-helpers/SecureTargetMock.sol b/contracts/test-helpers/SecureTargetMock.sol
index bd3a7dae2..382c4b53d 100644
--- a/contracts/test-helpers/SecureTargetMock.sol
+++ b/contracts/test-helpers/SecureTargetMock.sol
@@ -5,3 +5,9 @@ contract SecureTargetMock {
     return true;
   }
 }
+
+contract Deployer {
+  function deployContract() returns (address) {
+    return new SecureTargetMock();
+  }
+}