Bug Bounty Program

Report a security vulnerability in TxFlow to [email protected]. Rewards run up to 150,000 USDC for a Critical finding, paid for responsible disclosure and scaled to severity.

In scope

TxFlow Mainnet — security vulnerabilities that could cause:

• loss of user funds
• unauthorized state transitions
• incorrect order matching
• incorrect liquidation or settlement
• node or API outages
• state divergence
• logical errors in TxFlow Core

TxFlow Testnet — testnet-only features and their interaction with TxFlow Core, nodes, and API services. Payouts for testnet-only issues may be lower than for a Mainnet issue of the same severity.

Other experimental Testnet features are not in scope unless TxFlow announces otherwise — reports are still welcome.

Submitting a report

Include all of the following:

• a clear explanation of the bug
• an impact assessment
• detailed reproduction steps
• a proof of concept, where applicable

Send it to [email protected]. If several people report the same issue, the first valid report received is the one eligible for a reward.

An issue is not a new, reward-eligible report if, before your submission, it was already recorded internally by TxFlow, disclosed in a public audit report, under investigation or remediation, or covered by an earlier valid report from someone else. TxFlow determines whether an issue was already known.

TxFlow will not pursue legal action over security research conducted in good faith and in compliance with this program.

Prohibited activity

• Testing on Mainnet or production systems.
• Phishing or other social engineering.
• Extended or large-scale DDoS. Demonstrating mishandling of a temporary load spike is allowed only to the extent reasonably necessary, and without material disruption.
• Testing third-party systems, apps, wallets, browser extensions, or websites, unless the issue leads directly to an in-scope TxFlow vulnerability.
• Ransom demands or threats.
• Public disclosure before a fix ships and TxFlow authorizes disclosure.
• Publishing, or threatening to publish, personal or otherwise sensitive information without consent.
• Exploiting a vulnerability for financial gain beyond the reward available here.
• Bypassing these procedures or acting outside the stated scope.

Eligibility

• Submit directly to [email protected]. Do not use external sites unless TxFlow announces an official platform.
• Comply with any applicable KYC/KYB, sanctions screening, and payout procedures.
• Be able to receive a reward through a payment method TxFlow designates.
• Keep the vulnerability and related communications confidential until TxFlow authorizes disclosure.
• TxFlow must be able to reproduce the finding.
• Contributors to the affected code are not eligible in relation to that code.

Not eligible

• Issues already known to TxFlow — internally recorded, disclosed in a public audit report, already being tracked or remediated, or previously reported by someone else in a valid report.
• Reports without enough detail — no step-by-step instructions, reproducible example, or proof of concept.
• Issues requiring highly unlikely or unreasonable user behaviour.
• Issues caused by outdated software, unsupported environments, or systems TxFlow no longer supports.
• Issues requiring root access, a jailbroken or compromised device, or operator compromise unrelated to a TxFlow vulnerability.
• Issues in third-party libraries, extensions, tools, wallets, or applications that do not lead to a direct TxFlow vulnerability.
• Non-security bugs, including minor performance issues with no meaningful security impact.
• Issues contingent on extreme or unrealistic market conditions.

Reward classification

Ranges are maximums. The actual amount reflects both impact and likelihood, and classification examples are illustrative and subject to change.

General conditions

• No payment is made for submissions that fall outside scope or fail the eligibility criteria.
• TxFlow determines the validity, classification, and reward amount of any submission at its sole discretion.
• All submissions may be used by TxFlow for remediation, testing, and security improvement.