AuditOne

EN Subscribe to our new Newsletter for Certification Body Professionals & ISO Auditors → Here View all bounties Participate AuditOne Solidity AuditOne operates TIC OS, the operating system for certification and inspection bodies, a marketplace of vetted security and ISO auditors, and security services such as smart contract audits and penetration tests. End date: December 31, 2028 KYC: Required NO Range of bounty $300 - $10,000 Severity Critical $3,000 - $10,000 High $1,000 - $3,000 Medium $300 - $1,000 Low up to $300 About AuditOne AuditOne is an audit infrastructure provider. We operate TIC OS, the operating system for certification and inspection bodies, a marketplace of vetted security and ISO auditors, and security services such as smart contract audits and penetration tests. This program covers our smart contracts, our web applications and the digital infrastructure behind them, with a particular focus on TIC OS. Assets in Scope Smart contracts Discount Pool: 0x28e59a982584987708D68754459e0375c9Caf77A (IOTA EVM) Web applications TIC OS: https://cockpit.auditone.io/ (including its APIs, client portals and auditor views) Auditor app: https://auditor.auditone.io Website: www.auditone.io Infrastructure Domains and subdomains under auditone.io and the cloud infrastructure operated by AuditOne for these applications. Severity and Rewards Severity and reward amount are determined by AuditOne based on demonstrated impact. Critical ($3,000 to $10,000) Reserved exclusively for vulnerabilities in the in-scope AuditOne smart contracts that allow an attacker to steal assets, meaning direct theft of tokens or funds held in the Discount Pool. No web application or infrastructure finding qualifies as Critical. High ($1,000 to $3,000) Access to another customer's data in TIC OS (cross-tenant data access), including through AI features or prompt injection Account takeover or authentication bypass on TIC OS or the auditor marketplace Remote code execution on AuditOne servers Injection flaws (SQL, NoSQL, command) leading to data extraction or modification Privilege escalation to administrator or organisation owner roles Forging, altering or revoking certificates or audit reports without authorisation Smart contract flaws causing permanent freezing of funds or unauthorised minting without direct theft Medium ($300 to $1,000) Stored Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) on state-changing actions Insecure direct object references exposing limited data within a single tenant Role or permission bypass within a tenant, for example an auditor accessing records outside their assignment Server-Side Request Forgery (SSRF) without access to internal systems Exposure of secrets, credentials or sensitive configuration Business logic flaws in audit, certification or payment workflows Smart contract flaws causing temporary freezing of funds or contract-level denial of service Low (up to $300) Reflected XSS requiring significant user interaction Open redirects Missing rate limiting on login, password reset or other sensitive endpoints User or account enumeration Smart contract issues without impact on assets, for example incorrect event emission or view function errors Out of Scope Infrastructure and services of third-party providers (cloud hosting, website builder, email, payment and analytics providers), even where AuditOne uses them Websites and applications not listed above, including those of partners or customers Pricing oracles and third-party smart contracts Clickjacking on pages without sensitive actions, self-XSS, missing security headers or email records (SPF, DKIM, DMARC) without demonstrable impact Findings only reproducible in outdated or unsupported browsers Reports from automated scanners without a working proof of concept Issues already known to us or reported by another researcher first Rules and Requirements The following activities are prohibited: Any testing with mainnet or public testnet contracts; all smart contract testing should be done on private testnets Any testing with pricing oracles or third-party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Accessing, modifying or deleting data belonging to other users or customers; if you encounter such data, stop immediately and report it Using any account other than your own test accounts; test accounts on a dedicated TIC OS tenant are available on request Creating, altering or revoking real certificates or audit reports Denial of service attacks, load testing or automated scanning that degrades service for certification bodies using TIC OS Physical attacks against AuditOne offices or data centres Publicly disclosing a vulnerability before it has been fixed and we have agreed to disclosure Reporting Submit findings via the AuditOne app with a clear description, the affected asset, steps to reproduce and a proof of concept. Only the first valid report of a vulnerability is eligible for a reward. KYC is required for individuals before payout. Safe Harbour Research conducted in good faith and within these rules will not lead to legal action by AuditOne. How it works Severity ranking Code of Conduct About the Company AuditOne envisions a digital world where high-quality security and absolute transparency are fundamental principles, not afterthoughts. At the heart of this mission is our TIC OS ("Testing, Inspection & Certification Operating System") for certification bodies. This specialized AI-native ERP system serves as the foundational infrastructure for the entire security lifecycle, automating complex workflows and ensuring institutional-grade reliability. Rather than viewing an audit as a static event, our AI-native operating system allows for a modular, comprehensive approach to project integrity. By integrating advanced technology with deep human expertise, AuditOne is setting the benchmark for how trust is built and maintained in the decentralized economy. Newsletter Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. For Projects Request Audit Submit a Bounty AI Systems Audit Penetration Test KYC TIC OS Price Calculator For Auditors Start Auditing Auditing Tools Academy For Community AI Lite Paper Blog Ambassador Program Newsletters Company About Us Partnerships Docs Brand guidelines Privacy & Cookies Trust Center Imprint ©2026 AuditOne GmbH. All rights reserved. X Request a service or product from AuditOne Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. Twitter Medium LinkedIn YouTube