- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 3
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 from $5,000 |
| High |
|
$4,000 from $2,000 |
| Medium |
|
$2,000 from $1,000 |
| Low |
|
$500 from $250 |
Earlier reward tables (1)
- 12 Nov 2026 to 12 Nov 2026: Critical up to $10,000
Scope
4 assets you may test, 4 excluded.
Source code 4
- https://github.com/Agoric/agoric-sdk/tree/master/packages/ERTP No bounty
- https://github.com/Agoric/agoric-sdk/tree/master/packages/zoe No bounty
- https://github.com/endojs No bounty
- https://github.com/endojs/endo/tree/master/packages/ses No bounty
Out of scope (4)
- https://github.com/Agoric/agoric-sdk/tree/master/packages/inter-protocol
- agoric.com
- http://agoric.zoom.us
- https://agoricopco.slack.com
Changes
Tracked since 12 Nov 2026. Last checked 30 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-39532 | SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 prior to 0.17.1, 0.16.0 prior to 0.16.1, 0.15.0 prior to 0.15.24, 0.14.0 prior to 0.14.5, an 0.13.0 prior to 0.13.5, there is a hole in the confinement of guest applications under SES that may manifest as either the ability to exfiltrate information or execute | Critical 9.8 | 8 Aug 2023 |
| CVE-2021-23543 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. | Critical 9.8 | 10 Jan 2022 |
| CVE-2021-23594 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. | Critical 9.8 | 10 Jan 2022 |