Chia Network bug bounty programs
chia.net Updated
Chia Network runs two public programs: a HackerOne bug bounty paying up to $50,000 and a Sorona bug bounty paying up to $5,000. It also owns chialisp.com, which runs one more program.
- Top reward
- $50,000
- HackerOne
- Programs
- 3
- 3 pay cash
- Targets in scope
- 26
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs Chia Network runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Chia Network
HackerOne · The company-wide program. Pays up to $50,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Chia Network
HackerOne · Bug bounty |
$50k (highest) | $4,000 | $2,000 | $500 | $50,000 | Full | – | 12 hours average | Open |
|
Chia
Sorona · Bug bounty |
– | $5,000 (highest) | $2,500 (highest) | $625 (highest) | $5,000 | Partial | – | 2 days promised | Open |
-
- Critical
- $50k (highest)
- High
- $4,000
- Medium
- $2,000
- Low
- $500
- Safe harbor
- Full
- First response
- 12 hours average
-
- Critical
- –
- High
- $5,000 (highest)
- Medium
- $2,500 (highest)
- Low
- $625 (highest)
- Safe harbor
- Partial
- First response
- 2 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Chia Network owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
26 targets across all 3 programs, each listed once with the programs that cover it. 11 excluded.
-
chia-blockchain in full: the full node and its peer protocol, mempool and block validation, the farmer, harvester and timelord services, the wallet daemon, plotting, and the RPC and daemon interfaces each of those exposes
Products and areas
Covered by Chia
-
chia-blockchain-gui, the desktop wallet application, which carries a bounty-eligible source-code row of its own
Products and areas
Covered by Chia
-
chia_rs in full: the consensus types, block and spend-bundle validation, condition checking, BLS signature verification, and the coin and puzzle paths the node calls into
Products and areas
Covered by CLVM
-
chia_rs, the Rust consensus and type library the node links against and that third-party wallets and pools embed directly, covering block and spend-bundle validation, condition checking, BLS handling and the Python bindings it ships
Products and areas
Covered by Chia
-
chiapos, the proof-of-space implementation: plotting, the plot file format and proof verification
Products and areas
Covered by Chia
-
chiavdf, the verifiable-delay-function implementation timelords run, covering proof generation and verification
Products and areas
Covered by Chia
-
clvm_rs and chia_rs each hold a bounty-eligible SOURCE_CODE row of their own on the Chia Network program, both tagged "Chia RUST implementations" and both at maximum severity critical. They are separate rows from the node and the desktop app, so the VM is covered in its own right and anything in either library is accepted
Products and areas
Covered by CLVM
-
clvm_rs, the ChiaLisp VM that evaluates every spend, including its serialization, cost accounting and FFI surface
Products and areas
Covered by Chia
-
Serialization and deserialization of CLVM programs and of the tree structures they evaluate over
Products and areas
Covered by CLVM
-
The Chia Signer iOS application, which the scope table lists across both its App Store entry and its TestFlight build
Products and areas
Covered by Chia
-
The CLVM interpreter in clvm_rs: operator dispatch, cost accounting, and how atoms and cons cells are allocated, compared and released
Products and areas
Covered by CLVM
-
The cost model and every operator it prices, which is a consensus rule rather than local tuning
Products and areas
Covered by CLVM
-
The hosted Chia vault, listed as two URL assets at critical severity: vault.chiatest.net and api.vault.chiatest.net
Products and areas
Covered by Chia
-
The packaging surface of both libraries: the Python wheels they ship, the generated bindings, and the FFI boundary between the Rust core and the nodes, wallets and pools that embed them
Products and areas
Covered by CLVM
-
The program's structured scope carries six bounty-eligible SOURCE_CODE assets under github.com/Chia-Network, every one of them at maximum severity critical: chia-blockchain, chia-blockchain-gui, chia_rs, clvm_rs, chiapos and chiavdf. A security issue anywhere in any of them is accepted, and the hosted vault and the iOS signer sit alongside them as separate critical assets
Products and areas
Covered by Chia
No target matches. Try part of a host name, such as the company name.
Out of scope 11
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Any testing pointed at mainnet instead of testnet10 or testnet11
CLVM
-
Anything tested against mainnet rather than testnet10 or testnet11, which the program rules out regardless of what you find
Chia
-
chia-blockchain and chia-blockchain-gui, which are the node and the desktop application rather than the VM and are scoped separately
CLVM
-
chiapos, the proof-of-space implementation, and chiavdf, the verifiable delay function, both of which have their own scope rows
CLVM
-
Duplicate reports where you are not the first person to have filed the issue
Chia
-
Duplicates where someone else filed the same VM issue first
CLVM
-
Findings with no demonstrated security impact, including configuration observations and scanner output
Chia
-
Reports without a working proof of concept or enough detail to reproduce the evaluation
CLVM
-
Reports without a working proof of concept or without sufficient reproduction detail
Chia
-
Social-engineering attacks aimed at the special payout tier: the program states plainly that it "must require no interaction of the user, social engineering attacks are excluded"
Chia
-
The Chia Cloud wallet at vault.chiatest.net, its API, and the iOS signer application
CLVM
Recent changes
Reward and scope changes across every Chia Network program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Chia Network products, from the NVD.
-
CVE-2026-3194 Low
A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been published and may be used. T
-
CVE-2026-3194 Low
A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been published and may be used. T
-
CVE-2026-3193 Low
A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separat
-
CVE-2026-3193 Low
A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separat
-
CVE-2026-3192 Low
A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the component RPC Credential Handler. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has
-
CVE-2026-3192 Low
A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the component RPC Credential Handler. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has
-
CVE-2022-36447 High
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. T
-
CVE-2022-36447 High
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. T
About this page
This page gathers every public program listed under chia.net and the companies Chia Network owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Chia Network.
Something wrong or missing? Report a correction.