Bug Bounty Program

Report a security vulnerability in TxFlow to [email protected]. Rewards run up to 150,000 USDC for a Critical finding, paid for responsible disclosure and scaled to severity.

In scope

TxFlow Mainnet — security vulnerabilities that could cause:

• loss of user funds
• unauthorized state transitions
• incorrect order matching
• incorrect liquidation or settlement
• node or API outages
• state divergence
• logical errors in TxFlow Core

TxFlow Testnet — testnet-only features and their interaction with TxFlow Core, nodes, and API services. Payouts for testnet-only issues may be lower than for a Mainnet issue of the same severity.

Other experimental Testnet features are not in scope unless TxFlow announces otherwise — reports are still welcome.

Where the code lives

TxFlow does not publish its node, API, or frontend source in a public repository. There is nothing to clone and review: scope is the running Mainnet and Testnet systems above, plus the bridge contract deployed on Arbitrum at 0xcDE3F99bCB4c91e19124e41730489EAeFEc24565 (see Audits).

A GitHub repository, npm package, or PyPI project whose name contains "TxFlow" is not ours unless it is listed on Official Links. Several unaffiliated projects use the name. Findings against code we do not run are out of scope and not reward-eligible, so confirm the target against that page before you spend time on it — and if you are unsure whether something belongs to TxFlow, ask at [email protected] first.

Submitting a report

Include all of the following:

• a clear explanation of the bug
• an impact assessment
• detailed reproduction steps
• a proof of concept, where applicable

Send it to [email protected]. If several people report the same issue, the first valid report received is the one eligible for a reward.

An issue is not a new, reward-eligible report if, before your submission, it was already recorded internally by TxFlow, disclosed in a public audit report, under investigation or remediation, or covered by an earlier valid report from someone else. TxFlow determines whether an issue was already known.

TxFlow will not pursue legal action over security research conducted in good faith and in compliance with this program.

Acknowledgement without a reward

Not every valid report earns a payout — an issue can be already known, below the severity floor, or outside the reward scope while still being a genuine, well-written contribution. For those, TxFlow offers public acknowledgement instead of a reward:

• Ask for it in your report, or in reply once we have triaged it. Acknowledgement is opt-in; we credit nobody by default.
• Tell us the name or handle you want credited, and whether you want a link alongside it.
• Credit is published only after the issue is resolved and TxFlow authorizes disclosure. Everything in Eligibility about confidentiality until then still applies.
• You can decline credit, or ask to be listed anonymously.

Acknowledgement is not a reward and does not change the reward decision for a report. Where a report does qualify for a payout, you can take both.

Prohibited activity

• Testing on Mainnet or production systems.
• Phishing or other social engineering.
• Extended or large-scale DDoS. Demonstrating mishandling of a temporary load spike is allowed only to the extent reasonably necessary, and without material disruption.
• Testing third-party systems, apps, wallets, browser extensions, or websites, unless the issue leads directly to an in-scope TxFlow vulnerability.
• Ransom demands or threats.
• Public disclosure before a fix ships and TxFlow authorizes disclosure.
• Publishing, or threatening to publish, personal or otherwise sensitive information without consent.
• Exploiting a vulnerability for financial gain beyond the reward available here.
• Bypassing these procedures or acting outside the stated scope.

Eligibility

• Submit directly to [email protected]. Do not use external sites unless TxFlow announces an official platform.
• Comply with any applicable KYC/KYB, sanctions screening, and payout procedures.
• Be able to receive a reward through a payment method TxFlow designates.
• Keep the vulnerability and related communications confidential until TxFlow authorizes disclosure.
• TxFlow must be able to reproduce the finding.
• Contributors to the affected code are not eligible in relation to that code.

Not eligible

• Issues already known to TxFlow — internally recorded, disclosed in a public audit report, already being tracked or remediated, or previously reported by someone else in a valid report.
• Reports without enough detail — no step-by-step instructions, reproducible example, or proof of concept.
• Issues requiring highly unlikely or unreasonable user behaviour.
• Issues caused by outdated software, unsupported environments, or systems TxFlow no longer supports.
• Issues requiring root access, a jailbroken or compromised device, or operator compromise unrelated to a TxFlow vulnerability.
• Issues in third-party libraries, extensions, tools, wallets, or applications that do not lead to a direct TxFlow vulnerability.
• Non-security bugs, including minor performance issues with no meaningful security impact.
• Issues contingent on extreme or unrealistic market conditions.

Reward classification

Ranges are maximums. The actual amount reflects both impact and likelihood, and classification examples are illustrative and subject to change.

General conditions

• No payment is made for submissions that fall outside scope or fail the eligibility criteria.
• TxFlow determines the validity, classification, and reward amount of any submission at its sole discretion.
• All submissions may be used by TxFlow for remediation, testing, and security improvement.