Bug bounty
Found a way to break GhostFi? Tell us privately. We pay for valid reports that put users or their funds at risk.
Draft, not live yet
Rewards
The reward depends on the severity tier. We decide the tier, based on the impact we can reproduce.
| Severity | Reward |
|---|---|
| Critical | Up to $5,000 |
| High | Up to $1,500 |
| Medium | Up to $500 |
| Low | Up to $100 |
In scope
- The GhostFi converter: quotes, orders and the order engine, on ghostfi.io and in the API.
- The relay wallets and deposit addresses that carry an order.
- PayMe links and the pages behind them.
- Pay many (batch) orders.
- The GhostFi site, ghostfi.io.
- The Telegram bot, @Ghostfi_Privacy_bot.
Anything else, including third-party services we use, social accounts and other people's wallets, is out of scope.
Severity tiers
Critical
You can move, steal or freeze user funds, or take over a relay wallet or the keys behind it.
High
You can redirect a payout to another address, break the integrity of an order (change its amount, route, status or destination after it was created), or bypass the checks that protect an order.
Medium
You can read another user's order data (addresses, amounts, status), or act on an order you do not own.
Low
A smaller leak or weakness with limited impact, such as a way to see internal details, or a bug in the bot or the site that exposes a user to risk but needs the user to do something unusual.
Reports that only show a missing best practice, with no way to use it, are usually not paid.
Rules
- Test only with your own orders and your own wallets. Never test against other users' orders.
- No denial of service, no flooding, no load tests.
- No social engineering, phishing or physical attacks, on us, our team or our users.
- Report privately. Do not post the bug, a proof or user data anywhere public before we have fixed it and said you can.
- Stop as soon as you have shown the problem. Do not keep, move or spend funds that are not yours, and do not read more data than you need.
- One report per root cause. If two people report the same bug, the first valid report counts.
How to report
Send your report through the support chat on ghostfi.io, or by direct message to @GhostFi_Privacy on X. Do not post it publicly.
Include what you found, the steps to reproduce it, which tier you think it is, and where we can reach you. Use test orders of your own and keep the amounts small.