Account verification bypass leading to account takeover. Severity: Critical, vulnerability type: Authentication bypass, reported through Direct disclosure on 13 Jan 2025. Bounty $5,000.
Jan 2025 Weak JWT signing secret allowed token forgery. Severity: Critical, vulnerability type: Weak JWT secret, reported through Direct disclosure on 18 Apr 2025. Bounty $250.
Apr Administrative role injection during account creation. Severity: High, vulnerability type: Mass assignment, reported through YesWeHack on 13 May 2025. Bounty ≈ $2,318. Referral commission rate manipulation. Severity: High, vulnerability type: Business logic, reported through HackenProof on 21 May 2025. Bounty $5,000. Multisig API key IDOR granting unauthorized wallet control. Severity: High, vulnerability type: IDOR, reported through HackenProof on 29 May 2025. Bounty $5,000.
May Exposed container image disclosed internal source code. Severity: Low, vulnerability type: Information disclosure, reported through HackenProof on 26 Aug 2025. Bounty $100.
Aug Open administrator registration exposed summit attendee data. Severity: High, vulnerability type: Access control, reported through HackenProof on 28 Oct 2025. Bounty $500.
Oct Public database exposed an administrative GitLab token. Severity: Critical, vulnerability type: Credential exposure, reported through HackenProof on 3 Dec 2025. Bounty $1,000.
Dec Public OAuth credentials led to administrator compromise. Severity: Critical, vulnerability type: Credential exposure, reported through HackenProof on 31 Jan 2026. Bounty $3,000.
Jan 2026 Staking race condition created illegitimate reward eligibility. Severity: Medium, vulnerability type: Race condition, reported through HackenProof on 23 Mar 2026. Bounty $2,000.
Mar Supabase access-control issue allowed administrator escalation. Severity: Medium, vulnerability type: Broken access control, reported through OOOSEC on 29 Apr 2026. Bounty $1,000.
Apr Directus exposure disclosed personal data and enabled escalation. Severity: Low, vulnerability type: Security misconfiguration, reported through HackenProof on 1 May 2026. Bounty $100. Weak JWT secret enabled user and administrator account takeover. Severity: Critical, vulnerability type: Weak JWT secret, reported through HackenProof on 5 May 2026. Bounty $2,000 total for pentest. HTML injection in verification emails. Severity: High, vulnerability type: HTML injection, reported through HackenProof on 5 May 2026. Bounty $2,000 total for pentest. MFA reconfiguration bypass allowed 2FA takeover. Severity: High, vulnerability type: Authentication bypass, reported through HackenProof on 5 May 2026. Bounty $2,000 total for pentest. Untrusted forwarding header manipulated activity logs. Severity: Low, vulnerability type: IP spoofing, reported through HackenProof on 18 May 2026. Bounty $2,000 total for pentest. Subscription top-up validation allowed balance corruption. Severity: Critical, vulnerability type: Input validation, reported through HackenProof on 18 May 2026. Bounty $2,000 total for pentest. API endpoint exposed sensitive profile information. Severity: High, vulnerability type: Information disclosure, reported through HackenProof on 18 May 2026. Bounty $2,000 total for pentest. Public frontend bundle exposed ClickHouse Cloud credentials. Severity: Low, vulnerability type: Credential exposure, reported through OOOSEC on 28 May 2026. Bounty $300.
May KYC webhook mass assignment allowed verification bypass. Severity: Low, vulnerability type: Mass assignment, reported through HackenProof on 11 Jun 2026. Bounty $100. Unauthenticated administrator API exposed investor records. Severity: Medium, vulnerability type: Information disclosure, reported through HackenProof on 11 Jun 2026. Bounty $100. Transaction and application APIs exposed KYC records. Severity: Medium, vulnerability type: IDOR, reported through HackenProof on 12 Jun 2026. Bounty $100. WAF bypass exposed an administrative monitoring service. Severity: Low, vulnerability type: Security misconfiguration, reported through HackenProof on 30 Jun 2026. Bounty $200.
Jun Unvalidated adapter program allowed arbitrary signed invocation. Severity: High, vulnerability type: Business logic, reported through OOOSEC on 23 Aug 2026. Bounty $10,000.
Aug Inconsistent voting eligibility validation. Severity: Medium, vulnerability type: Business logic, reported through BugBounty.ch on 4 Sept 2026. Bounty ≈ $1,840.
Sep Starter Templates XSS (CVE-2026-102393). Severity: Medium, vulnerability type: Cross-site scripting (XSS), published by Patchstack on 5 Oct 2026. Bounty Not disclosed. Party deletion of an unlocked union member clears the union from locked sibling lists. Severity: Medium, vulnerability type: Not disclosed, payout received through SignalFisher on 9 Oct 2026. Bounty ≈ $1,805.
Oct 