Bug Bounty Program
Bullpen is committed to protecting our users, infrastructure, and ecosystem. We invite security researchers to identify and disclose vulnerabilities to help us improve the safety of the platform
Program Rules
Report privately with clear, reproducible steps to our ticketing system on Freshdesk (https://bullpen-help.freshdesk.com/support/tickets/new).
Reproduction is required. If we can’t reproduce an issue from your submission, it won’t qualify for a reward.
No social engineering. Phishing or tricking Bullpen staff, contractors, or community members is prohibited.
Act in good faith. Avoid privacy violations, data loss, service degradation, or interruptions.
No availability attacks. DoS/DDoS or traffic floods against Bullpen services are not allowed.
No disruptive exploitation. Attacks that directly disrupt services do not earn bounties.
Safe Testing Guidelines
Primary target:
app.bullpen.fi(web/PWA) and production APIs behind it.Auth & accounts: X / Google SSO, wallet linking (Solana + EVM), session management, account recovery.
Wallet & funds: Deposits/withdrawals/bridging UX initiated from Bullpen, referral & affiliate flows, and points accrual that could yield financial impact.
We do not operate a public testnet at this time. If your testing requires elevated or potentially risky actions, raise a ticket to coordinate a safe window, test accounts, rate limits, or staging access. Otherwise, use minimal sizes and non-destructive payloads.
Severity & Rewards
Critical
$10,000 – $25,000
High
$2,500 – $10,000
Medium
$500 – $2,500
Low
up to $500
Extras: At our discretion, qualifying reports may also receive Bullpen Points and community recognition after remediation.
How we think about severity (guidance, not exhaustive)
Critical: Direct compromise of funds, trading actions without authorization, bypassing authentication to take over accounts, arbitrary on-chain actions via Bullpen initiated without consent, or exploits that allow minting/withdrawing/stealing value or mass exfiltration of sensitive data.
High: Privilege escalation, significant data exposure, reliable integrity breaks (e.g., forging orders, PnL, referral fees, or points) with meaningful financial impact, or long-lived authentication/session flaws.
Medium: Targeted account impact, CSRF/XSS w/ state change, rate-limit bypass enabling abuse, restricted info disclosure with plausible exploitation.
Low: Limited-impact issues, mixed-content, clickjacking without impact, missing best-practice headers, or informational findings that aid future exploitation.
Final severity and payout are at Bullpen’s discretion, factoring in impact, likelihood, quality of report/PoC, and ease of exploitation.
Submission Process
Important:
Duplicate reports: first complete report qualifies.
Submit one vulnerability per report, unless a chain is required to demonstrate impact.
Multiple issues with the same root cause may be awarded as one bounty.
Rewards are paid in USDC after triage and remediation; KYC may be required for higher tiers or where legally required. Export-control/OFAC restrictions apply.
Prohibited Activity (Out-of-Scope Testing)
The following make a report ineligible and may trigger further investigation:
Disruptive testing on production that impacts availability (DoS/DDoS, traffic floods).
Phishing/social engineering or physical security attacks.
Testing that targets third-party platforms outside our control (e.g., SSO providers, wallets, browser extensions, Hyperliquid’s core systems).
If you find issues in third-party systems, report them to those vendors.
Violating privacy, accessing data or accounts you don’t own without explicit consent.
Public disclosure before remediation without written authorization.
Ransom demands or exploiting vulnerabilities for personal gain beyond the bounty.
Eligibility
Reports must be sent directly to Bullpen via [email protected] or a private Discord ticket. Public posts, DMs, or third-party sites aren’t eligible.
Researchers must maintain confidentiality until we approve disclosure.
We may require KYC (higher tiers) and reserve the right to disqualify reports from sanctioned jurisdictions or entities.
You must follow the rules and safe testing guidelines above.
Not Eligible (Common Non-Security Findings)
UI/UX bugs without a security impact; typos or cosmetic issues.
Reports lacking sufficient detail to reproduce or without a plausible impact.
Vulnerabilities requiring highly improbable user actions or unrealistic conditions.
Issues in outdated browsers/OS/plugins not supported by Bullpen.
Findings requiring physical access to a user device.
Bugs in third-party libraries/services that don’t create direct risk to Bullpen users.
Purely theoretical attacks without evidence of exploitability/impact.
Community moderation/Discord bot quirks that don’t affect security.
Our Commitments to Researchers
Safe Harbor: If you comply with this policy and act in good faith, we will not pursue legal action. Coordinate with us, respect privacy/data boundaries, and avoid service disruption.
Timely Response: We aim to acknowledge within 72 hours, provide a triage result after initial review, and keep you updated through remediation.
Fair Rewards: We classify issues consistently and reward based on severity, impact, and report quality.
Coordinated Disclosure: We’ll agree on a public disclosure timeline after remediation. Please do not disclose without our written approval.
By submitting a report, you acknowledge that it becomes the property of Bullpen for the purposes of remediation and improving platform security. Bullpen reserves full discretion in severity classification and payout amounts.
Thank you for helping keep Bullpen and our community safe.
Last updated