Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Anchor bug bounty programs

anchor-lang.com Updated

Anchor runs one public program: a Sorona bug bounty.

Top reward
Not published
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Anchor runs.

  • Anchor

    Sorona · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Partial
    KYC
    Required
    First response
    3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 8 excluded.

  • https://www.anchor-lang.com

    Web

  • anchor-spl, the wrappers around SPL Token, Associated Token and Metaplex accounts that most Anchor programs use instead of writing those checks themselves

    Products and areas

  • IDL generation and the on-chain IDL account, together with the Borsh serialisation and deserialisation used on both sides of the boundary

    Products and areas

  • The anchor CLI and avm: build, verifiable build, test, deploy and upgrade, the tooling standing between reviewed source and the bytes that land on chain

    Products and areas

  • The anchor-lang runtime crate and its account-validation layer: #[account], #[derive(Accounts)], constraint expressions, the discriminator mechanism, AccountLoader and the zero-copy paths

    Products and areas

  • The procedural macros behind #[program], including instruction dispatch and whatever the derive macros actually expand to underneath the source a developer reads

    Products and areas

  • The program grades the whole of that surface: bypassing a fundamental Anchor check is Critical, denial of service is Medium, and everything remaining in the repository is Low

    Products and areas

  • The repository is the boundary the program draws: anything whose source code exists in coral-xyz/anchor is in, and anything whose source does not is out

    Products and areas

  • The Rust and TypeScript clients, anchor-client and @coral-xyz/anchor, covering coders, event parsing and transaction construction

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Any encrypted credentials, auth tokens or similar checked into the repository

  • Anything whose source code does not exist in the repository, including web properties not explicitly listed on the program page

  • Attacks that require social engineering

  • Awards to anyone who has not completed KYC and signed the Solana Foundation participation agreement

  • Bugs in dependencies, which the policy says to take upstream

  • Findings already rewarded under a protocol's own bounty, which the policy will not pay a second time

  • Undeveloped automated tooling results such as raw scanner output, though a finding carried through to a developed proof of concept is accepted

  • Vulnerability classes that are user error rather than library defects. The rubric asks whether the bug was public knowledge previously, which can make it a hazard for users of Anchor rather than an issue within Anchor.

Recent changes

Reward and scope changes across every Anchor program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Anchor products, from the NVD.

Search NVD
  • CVE-2026-45137 High

    Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions. In the TryFrom<&'a AccountInfo<'a>> implementation for Prog

About this page

This page gathers every public program listed under anchor-lang.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.