ShapeShift bug bounty programs
shapeshift.com Updated
ShapeShift runs one public program: a HackenProof bug bounty paying up to $10,000.
- Top reward
- $10,000
- HackenProof
- Programs
- 1
- 1 pays cash
- Targets in scope
- 6
- 4 types
- Last change
- 22 Sep 2026
- 1 month ago
Where to report
The one public program ShapeShift runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
ShapeShift
HackenProof · Bug bounty |
$10k | – | – | – | $10,000 | – | – | – | Open |
-
- Critical
- $10k
- High
- –
- Medium
- –
- Low
- –
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
6 targets. 8 excluded.
-
app.shapeshift.com
Domains
-
shapeshift.com
Domains
-
api.bitcoin.shapeshift.com
APIs
-
api.ethereum.shapeshift.com
APIs
-
https://play.google.com/store/apps/details?id=com.shapeshift.droid_shapeshift&hl=en_US&gl=US
Android
-
https://apps.apple.com/us/app/shapeshift-buy-trade-crypto/id996569075
iOS
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
auth.shapeshift.com
-
beta.shapeshift.com
-
coincap.io
-
portal.shapeshift.io
-
portis.io
-
shapeshift-io.hellonext.co
-
shapeshift.zendesk.com
-
Physical (or emulated!) KeepKey devices
Recent changes
Reward and scope changes across every ShapeShift program, newest first.
-
Back
Open for reports again.
Recent CVEs
Published vulnerabilities in ShapeShift products, from the NVD.
-
CVE-2023-27892 Low
Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the har
-
CVE-2021-31616 High
Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.
-
CVE-2019-18672 High
Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachab
-
CVE-2019-14355 Low
On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side chann
-
CVE-2018-6875 High
Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to text containing characters that the device's font lacks.
About this page
This page gathers every public program listed under shapeshift.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.