Announcement on Launching Bug Bounty Program | Advanced cryptocurrency exchange to buy and sell Bitcoin, Ethereum, Litecoin, Monero, ZCash, DigitalNote,

Dear Users,

We are thrilled to launch our bug bounty program to make our crypto trading services more secure and reliable. We realize that even the most complete systems can still have vulnerabilities. Hence, we would like to encourage hackers to test and report any vulnerabilities on our platform by offering rewards. As a result, we can quickly address these issues and prevent any malicious attacks.

Our bug bounty program is open to anyone who discovers vulnerabilities in our software. We will offer rewards for eligible vulnerability reports, with the amount ranging from $50 to $2,000 USD depending on the severity of the issue and the quality of the report.

Bug Severity & Reward

Severity	Reward
Critical	$1,000 - $2,000
High	$400 - $800
Medium	$150 - $300
Low	$50 - $100

Focus Area IN-SCOPE VULNERABILITIES (WEB, MOBILE)

Business logic issues

Payments manipulation

Remote code execution (RCE)

Injection vulnerabilities (SQL, XXE)

File inclusions (Local & Remote)

Access Control Issues (IDOR, Privilege Escalation, etc)

Leakage of sensitive information

Server-Side Request Forgery (SSRF)

Cross-Site Request Forgery (CSRF)

Cross-Site Scripting (XSS)

Directory traversal

Other vulnerability with a clear potential loss

OUT OF SCOPE: WEB VULNERABILITIES

Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk (at our sole discretion). In general, the following vulnerabilities do not correspond to the severity threshold:

Vulnerabilities in third-party applications

Assets that do not belong to the company

Best practices concerns

Recently (less than 30 days) disclosed 0day vulnerabilities

Vulnerabilities affecting users of outdated browsers or platforms

Social engineering, phishing, physical, or other fraud activities

Publicly accessible login panels without proof of exploitation

Reports that state that software is out of date/vulnerable without a proof of concept

Reports that generated by scanners or any automated or active exploit tools

Vulnerabilities involving active content such as web browser add-ons

Most brute-forcing issues without clear impact

Denial of service (DoS/DDoS)

Theoretical issues

Moderately Sensitive Information Disclosure

Spam (sms, email, etc)

Missing HTTP security headers

Infrastructure vulnerabilities, including:

Certificates/TLS/SSL-related issues
DNS issues (i.e. MX records, SPF records, DMARC records etc.)
Server configuration issues (i.e., open ports, TLS, etc.)
Open redirects
Session fixation
User account enumeration
Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking
Descriptive error messages (e.g. Stack Traces, application or server errors)
Self-XSS that cannot be used to exploit other users
Login & Logout CSRF
Weak Captcha/Captcha Bypass
Lack of Secure and HTTPOnly cookie flags
Username/email enumeration via Login/Forgot Password Page error messages
CSRF in forms that are available to anonymous users (e.g. the contact form)
OPTIONS/TRACE HTTP method enabled
Host header issues without proof-of-concept demonstrating the vulnerability
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Content Spoofing without embedded links/HTML
Reflected File Download (RFD)
Mixed HTTP Content
HTTPS Mixed Content Scripts
Manipulation with Password Reset Token
MitM and local attacks

Attacks requiring physical access to a user's device

Vulnerabilities that require root/jailbreak

Vulnerabilities requiring extensive user interaction

Exposure of non-sensitive data on the device

Reports from static analysis of the binary without PoC that impacts business logic

Lack of obfuscation/binary protection/root(jailbreak) detection

Bypass certificate pinning on rooted devices

Lack of Exploit mitigations i.e., PIE, ARC, or Stack anaries

Sensitive data in URLs/request bodies when protected by TLS

Path disclosure in the binary

Sensitive information retained as plaintext in the device’s memory

Crashes due to malformed URL Schemes or Intents sent to exported Activity/Service/Broadcast Receiver (exploiting these for sensitive data leakage is commonly in scope)

Any kind of sensitive data stored in-app private directory

Runtime hacking exploits using tools like but not limited to Frida/ Appmon (exploits only possible in a jailbroken environment)

Shared links leaked through the system clipboard

Any URIs leaked because a malicious app has permission to view URIs opened.

Program Rules

Avoid using web application scanners for automatic vulnerability searching which generates massive traffic

Make every effort not to damage or restrict the availability of products, services, or infrastructure

Avoid compromising any personal data, interruption, or degradation of any service

Don’t access or modify other user data, localize all tests to your accounts

Perform testing only within the scope

Bypass certificate pinning on rooted devices

Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam

Don’t spam forms or account creation flows using automated scanners

In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.

Don’t break any law and stay in the defined scope

Any details of found vulnerabilities must not be communicated to anyone who is not a member of our Team or an authorized employee of this Company without appropriate permission

Disclosure Guidelines

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization

No vulnerability disclosure, including partial is allowed for the moment.

Please do NOT publish/discuss bugs

Eligibility and Coordinated Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

You must be the first reporter of a vulnerability.

The vulnerability must be a qualifying vulnerability

You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.

You must not be a former or current employee of us or one of its contractor.

Provide detailed but to-the point reproduction steps

Support Team

April 25, 2023