ZXMR

// Security

Bug bounty

Up to $100,000 for critical vulnerabilities in the ZXMR bridge protocol and its APIs. This program exists to find serious bugs before mainnet users do — not to police typos.

01

Scope

In scope

  • The bridge protocol smart contracts — ZXMR token, MintAttestation, OperatorRegistry, RedeemQueue, FeeDistributor, ProofOfReserves — on stagenet today, and on mainnet once launched.
  • The operator/API backend that serves federation status, proof-of-reserves, and mint/redeem data.

Out of scope

  • This website — copy, design, typos, broken links, or other UI/UX issues.
  • Third-party infrastructure ZXMR doesn't operate (RPC providers, block explorers, wallets).
  • Denial-of-service, spam, or rate-limit findings against public infrastructure.
  • Social engineering, phishing, or physical-access attacks.
  • Best-practice suggestions without a demonstrated exploit.
02

Rewards

CriticalUp to $100,000

Funds can be stolen or frozen, ZXMR can be minted without authorization, or the peg invariant can be broken.

HighAssessed case-by-case

Significant impact, but constrained — e.g. requires a compromised operator, or limited to temporarily griefing funds or availability.

MediumAssessed case-by-case

A real logic error with limited impact, or a critical-class bug that requires an unrealistic precondition.

LowAssessed case-by-case

Minor issues and hardening suggestions with no direct path to fund loss.

03

Rules

  1. Test only against stagenet or a local fork — never attempt to exploit anything against real user funds.
  2. Report privately first. Do not disclose publicly until a fix has shipped.
  3. One report per distinct vulnerability — duplicates are awarded to the first valid submission.
  4. Provide a clear, reproducible proof of concept, not just a description.
  5. Bounties are paid at the team's discretion based on severity, impact, and report quality, up to the $100,000 maximum for critical findings.
04

How to report

Include the affected contract or API, steps to reproduce, the potential impact, and a suggested fix if you have one.

Security contactTBD