Unstoppable Wallet Bug Bounties

Target	Type	Added on
	Websites and Applications - Native Mobile App	12 April 2022
	Websites and Applications - Native Mobile App	12 April 2022

Target

Type

Added on

Websites and Applications - Native Mobile App

12 April 2022

Target

Type

Added on

Websites and Applications - Native Mobile App

12 April 2022

Critical	Ability to execute system commands
Critical	Extract Sensitive data/files from the server such as /etc/passwd
Critical	Bypassing Authentication
Critical	Taking Down the application
Critical	Redirection of user deposits and withdrawals
Critical	Wallet interaction modification resulting in financial loss
Critical	Tampering with transactions submitted to the user’s wallet
Critical	Submitting malicious transactions to an already-connected wallet
High	Privilege escalation to access unauthorized functionalities
High	Spoofing content on the target application (Persistent)

Critical

Ability to execute system commands

Critical

Extract Sensitive data/files from the server such as /etc/passwd

Critical

Bypassing Authentication

Critical

Taking Down the application

Critical

Redirection of user deposits and withdrawals

Critical

Wallet interaction modification resulting in financial loss

Critical

Tampering with transactions submitted to the user’s wallet

Critical

Submitting malicious transactions to an already-connected wallet

High

Privilege escalation to access unauthorized functionalities

High

Spoofing content on the target application (Persistent)

Program's Out of Scope information

The following vulnerabilities are excluded from the rewards for this bug bounty program:

Attacks that the reporter has already exploited themselves, leading to damage
Attacks requiring access to leaked keys/credentials
Attacks requiring access to privileged addresses (governance, strategist) Apps Only
Theoretical vulnerabilities without any proof or demonstration
Vulnerabilities requiring unlikely user actions
Attacks requiring privileged access from within the organization
Feature requests
Best practices

The following activities are prohibited by this bug bounty program:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty