Totalcoin Bug Bounty Program

You can send bug report via email: [email protected] 

Rewards are distributed depending on the severity of the reported vulnerability.

Severity Level USD
Low     up to 200.00
Medium up to 500.00
High up to 2,500.00
Critical up to 30,000.00

Examples

Low:

  • Non-critical impact on performance of the platform
  • Lack of rate-limits (with impact)

Medium:

  • XSS (with impact)
  • CSRF (with impact)

High:

  • RCE
  • 2FA bypass
  • Privilege escalation attack
  • Critical impact on performance of the platform
  • Reading or changing of large amounts of sensitive data

Critical:

  • Authentication bypass
  • Unauthorized asset transfer
  • Manipulating funds balances

Ineligible conditions of Bug Bounty Program

  • Social Engineering
  • Any vulnerabilities in third-party or open-source libraries/software
  • Physical access to a user’s web browser or smartphone
  • DDOS (Distributed Denial of Service) attacks
  • Vulnerabilities that require 'MITM'
  • Any kind of brute-force attacks
  • Spam
  • Not reproducible vulnerabilities
  • Business logic errors
  • UX issues not relating to security impacts

Bounty payout is carried out in BTC or USDT to the internal Totalcoin platform address.