> For the complete documentation index, see [llms.txt](https://docs.bullpen.fi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bullpen.fi/support/bug-bounty-program.md). # Bug Bounty Program Bullpen is committed to protecting our users, infrastructure, and ecosystem. We invite security researchers to identify and disclose vulnerabilities to help us improve the safety of the platform ### Program Rules 1. **Report privately** with clear, reproducible steps to **our ticketing system on Freshdesk (**[**https://bullpen-help.freshdesk.com/support/tickets/new**](https://bullpen-help.freshdesk.com/support/tickets/new)**)**. 2. **Reproduction is required.** If we can’t reproduce an issue from your submission, it won’t qualify for a reward. 3. **No social engineering.** Phishing or tricking Bullpen staff, contractors, or community members is prohibited. 4. **Act in good faith.** Avoid privacy violations, data loss, service degradation, or interruptions. 5. **No availability attacks.** DoS/DDoS or traffic floods against Bullpen services are not allowed. 6. **No disruptive exploitation.** Attacks that directly disrupt services do not earn bounties. *** ### Safe Testing Guidelines * **Primary target:** `app.bullpen.fi` (web/PWA) and production APIs behind it. * **Auth & accounts:** X / Google SSO, wallet linking (Solana + EVM), session management, account recovery. * **Wallet & funds:** Deposits/withdrawals/bridging UX initiated from Bullpen, referral & affiliate flows, and points accrual that could yield **financial impact**. > We do not operate a public testnet at this time. If your testing requires elevated or potentially risky actions, [**raise a ticket**](https://bullpen-help.freshdesk.com/support/tickets/new) to coordinate a safe window, test accounts, rate limits, or staging access. Otherwise, use **minimal sizes** and **non-destructive** payloads. *** ### Severity & Rewards | Level | Bounty (USDC) | | -------- | --------------------- | | Critical | **$10,000 – $25,000** | | High | **$2,500 – $10,000** | | Medium | **$500 – $2,500** | | Low | **up to $500** | **Extras:** At our discretion, qualifying reports may also receive **Bullpen Points** and community recognition after remediation. #### How we think about severity (guidance, not exhaustive) * **Critical:** Direct compromise of funds, trading actions without authorization, bypassing authentication to take over accounts, arbitrary on-chain actions via Bullpen initiated without consent, or exploits that allow minting/withdrawing/stealing value or mass exfiltration of sensitive data. * **High:** Privilege escalation, significant data exposure, reliable integrity breaks (e.g., forging orders, PnL, referral fees, or points) with meaningful financial impact, or long-lived authentication/session flaws. * **Medium:** Targeted account impact, CSRF/XSS w/ state change, rate-limit bypass enabling abuse, restricted info disclosure with plausible exploitation. * **Low:** Limited-impact issues, mixed-content, clickjacking without impact, missing best-practice headers, or informational findings that aid future exploitation. > Final severity and payout are at Bullpen’s discretion, factoring in impact, likelihood, quality of report/PoC, and ease of exploitation. *** ### Submission Process **Important:** * Duplicate reports: **first complete** report qualifies. * Submit **one vulnerability per report**, unless a chain is required to demonstrate impact. * Multiple issues with the **same root cause** may be awarded as one bounty. * Rewards are paid in **USDC** after triage and remediation; **KYC may be required** for higher tiers or where legally required. Export-control/OFAC restrictions apply. *** ### Prohibited Activity (Out-of-Scope Testing) The following make a report ineligible and may trigger further investigation: * Disruptive testing on production that **impacts availability** (DoS/DDoS, traffic floods). * **Phishing/social engineering** or physical security attacks. * Testing that targets **third-party platforms** outside our control (e.g., SSO providers, wallets, browser extensions, **Hyperliquid’s core systems**). * If you find issues in third-party systems, report them to those vendors. * Violating privacy, accessing data or accounts you don’t own without explicit consent. * **Public disclosure** before remediation without written authorization. * Ransom demands or exploiting vulnerabilities **for personal gain** beyond the bounty. *** ### Eligibility * Reports must be sent **directly to Bullpen** via **** or a private Discord ticket. Public posts, DMs, or third-party sites aren’t eligible. * Researchers must **maintain confidentiality** until we approve disclosure. * We may require **KYC** (higher tiers) and reserve the right to disqualify reports from sanctioned jurisdictions or entities. * You must follow the **rules and safe testing guidelines** above. #### Not Eligible (Common Non-Security Findings) * UI/UX bugs without a security impact; typos or cosmetic issues. * Reports lacking sufficient detail to reproduce or without a plausible impact. * Vulnerabilities requiring highly improbable user actions or unrealistic conditions. * Issues in outdated browsers/OS/plugins not supported by Bullpen. * Findings requiring physical access to a user device. * Bugs in third-party libraries/services that **don’t** create direct risk to Bullpen users. * Purely theoretical attacks without evidence of exploitability/impact. * Community moderation/Discord bot quirks that don’t affect security. *** ### Our Commitments to Researchers * **Safe Harbor:** If you comply with this policy and act in good faith, we will not pursue legal action. Coordinate with us, respect privacy/data boundaries, and avoid service disruption. * **Timely Response:** We aim to acknowledge within **72 hours**, provide a triage result after initial review, and keep you updated through remediation. * **Fair Rewards:** We classify issues consistently and reward based on severity, impact, and report quality. * **Coordinated Disclosure:** We’ll agree on a public disclosure timeline after remediation. Please do not disclose without our written approval. *** By submitting a report, you acknowledge that it becomes the property of Bullpen for the purposes of remediation and improving platform security. Bullpen reserves full discretion in severity classification and payout amounts. **Thank you** for helping keep Bullpen and our community safe. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bullpen.fi/support/bug-bounty-program.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.