Aptos Function Values

Bug bounty Triaged by HackenProof Aptos Function Values: Program info Aptos Function Values Company: Aptos Scope Review: 189246 Submissions: 40 Total rewards: $0 KYC Required PoC Required Program left: 1 year ago Finished Submit report Contest is not active Program info Hackers 22 Reports 0 Aptos is a next-generation Layer 1 blockchain. Aptos’ breakthrough technology and programming language, Move, are designed to evolve, improve performance and strengthen user safeguards. The Aptos Foundation ("Aptos", "we", or "us") welcomes feedback from security researchers and the general public to help improve the security of the new Move on Aptos Compiler, and, at its sole discretion, offers bounty rewards ("Rewards") for security reports that identify previously unknown, in-scope security vulnerabilities. Aptos Foundation retains sole discretion to determine the amount of any Reward. All Scope Focus Area Program Rules Eligibility and Coordinated Disclosure Disclosure Guidelines Scope Search targets In scope Target │ Type │ Severity https://github.com/aptos-labs/aptos-core/tree/aptos-release-v1.33 Copy Code │ Critical https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-112.md Copy Other │ None Focus Area As part of a limited program, we are offering rewards of up to $1,000,000 to security researchers who identify security issues related to the new Function Values feature in Move. Critical Loss of Funds: up to $1,000,000 High OOM/Crash in VM: up to $50,000 Execution divergence: up to $50,000 Primitives (up to $50,000 ) Paranoid Mode Bypass Bytecode Verifier Bypass Reference Safety Bypass: Even if Paranoid Mode catches the issue afterward and there's no impact Type Safety Bypass: for instance, invoking a function f(x: Foo) , even though no public function constructs Foo Ability Bypasses: Hot Potato Bypass Copy Ability Bypass Store/Key Bypass Unauthorized Event Emission: Calling event::emit with T not defined in the caller's module. Out of Scope The following are not eligible for this program: API/Indexer issues; GAS charge issues (if not escaleted to a VM DOS); Variations in gas charges. Targets Specification : AIP-112 Target Release : aptos-release-v1.33 (currently on testnet) We are only interested in bugs caused by the Function Values feature introduced in Node release 1.33. Program Rules To be eligible for a Reward, you are required to: Play by the rules, including following these Rules and any other relevant agreements. If there is any inconsistency or conflict between these Rules and any other applicable terms, the applicable terms of these Rules will prevail; Submit an in-scope vulnerability as detailed above; Include detailed information and clear steps to reproduce the issue. Vulnerabilities must be reproducible using the code currently in scope for the Program, based on the current mainnet configuration, and must affect features that are either enabled or are set to be enabled via a governance proposal; Avoid any testing on live systems serving mainnet, testnet or devnet; all testing must be done locally; Report any vulnerability within 24 hours from discovery; Avoid disrupting our systems, destroying data, and/or harming users; Only use this platform to report and discuss vulnerability information with us; Provide us a reasonable amount of time to resolve the issue; Limit the data you access to the minimum required to effectively demonstrate a Proof of Concept in circumstances where a vulnerability provides unintended access to private data or secrets; Vulnerabilities based on social engineering or network Denial of Service (DoS) attacks are considered out of scope and are not eligible for Rewards under this program; Not engage in extortion. Duplicate Reports Rewards for duplicate reports will be split among reporters with first to report taking priority using the following equation: R: total reports ri: report priority bi: bounty share bi = 2 ^ (R - ri) / ((2 ^ R) - 1) Where report priority derives from the set of integers beginning at 1, where the first reporter has ri = 1, the second reporter ri = 2, and so forth. Note, reports that come in after the issue has been fully triaged and resolved will not be eligible for a Reward.. Eligibility and Coordinated Disclosure You ARE NOT eligible to participate in the Program if you are: A "Restricted Person" as defined in the Aptos Foundation Terms of Use . To receive a Bounty, you will be required to complete an identity verification process to confirm that you are not a Restricted Person. Under the age of 16. If you are at least 16 years old but are considered a minor in your place of residence, you must obtain your parent's or legal guardian's permission prior to participating in this Program. Currently an employee or provide services to the Aptos Foundation or are a former employee or provided services to the Aptos Foundation within the last 12 months of your submitted security report. Employed by an entity that does not allow you to participate in the Program. To receive a Reward, you will have to enter into an Agreement with Aptos Foundation and provide required information, which may include identity verification information and tax information or forms, such as a W-9 or W-8 for U.S. residents or citizens. Rewards are managed by Aptos Foundation and are denominated in United States Dollars (USD). Rewards may be paid partially or fully in digital assets at the sole discretion of Aptos Foundation. If you receive digital assets as part of your Reward, the value of the digital assets in USD will be determined at the time you execute your Agreement with Aptos Foundation and after you have satisfied all eligibility criteria. Token-based rewards may be subject to a lock-up period. Getting Started The Aptos Blockchain Whitepaper Aptos Blockchain Deep Dive Move - A Web3 Language and Runtime Engage with the Aptos community Disclosure Guidelines Do not discuss or disclose any vulnerabilities, even resolved ones, outside of this Program without the Aptos Foundation’s written consent. Live since 23 Jul 2025 Published date 23 Jul 2025 Last updated 25 May 2026 Range of bounty $0 - $1,000,000 Severity Critical $0 - $1,000,000 High $0 - $50,000 Medium $0 - $50,000 Low $0 - $50,000 blockchain smart contract Rust Move @0xd4ps KYC Verified 1 @INOCUSECLABS KYC Verified 2 re @rexnet111 KYC 3 Cp @CptnBloodBeard KYC 4 @shaggy Verified 5 Response type Business days First Response 3d Triage Time 7d Reward Time 90d Resolution Time 30d