Avalanche Websites and APIs
By Avalanche Bug bounty on HackenProof avax.network
- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- Payment
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
- Response
-
Within 3 days
First Response 3d
- Safe harbor
-
Partial
Do not intentionally exploit any vulnerabilities you found:
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 6 excluded.
Wildcard domains 4
- *.avalabs.org
- *.avax-dev.network
- *.avax.network
- *.avax-test.network
APIs 2
- api.avax.network
- api.avax-test.network
Out of scope (6)
- buy.avax.network
- chat.avalabs.org
- chat.avax.network
- community.avax.network
- docs.avax.network
- *.snowtrace.io
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Avalanche Websites and APIs (via HackenProof)'s policy.
While testing
-
Only reports of new, unknown vulnerabilities are eligible for a reward.
-
Vulnerabilities already publicly disclosed will not be eligible for a reward.
-
After reporting, details of a vulnerability may only be made public with expressed authorization from Ava Labs.
-
Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
-
Do not intentionally exploit any vulnerabilities you found:
-
Don’t access or modify user data you do not own, localize all tests to your accounts
-
Perform testing only within the scope
-
Social engineering (including phishing) targeting Ava Labs team members and community is strictly forbidden
-
Physical intrusion attempts targeting Ava Labs' property or data centers is strictly forbidden.
-
Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or Ava Labs security team member.
Not accepted
-
Any Denial-of-Service/Spam Attack of any API
-
Vulnerabilities in third-party applications
-
Unexploitable theoretical or best practices concerns
-
Recently (less than 30 days) disclosed 0day vulnerabilities
-
Vulnerabilities affecting users of outdated browsers or platforms
-
Social engineering, spam, phishing, physical, or other fraud activities
-
Most brute-forcing issues without clear impact
-
Non-sensitive Information Disclosure
-
Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking
-
Self-XSS that cannot be used to exploit other users
-
Missing cookie flags on non-sensitive cookies
-
CSRF on unauthenticated endpoints
-
OPTIONS/TRACE HTTP method enabled
-
Host header issues without proof-of-concept demonstrating the vulnerability
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Any attacks requiring physical access to a user's device
-
CSP issues unless exploitable with POC
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 36 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackenproof.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Bug bounty Triaged by HackenProof Avalanche Websites and APIs: Program info Avalanche Websites and APIs Company: Avalanche Scope Review: 270961 Submissions: 261 Total rewards: $22,150 Program left: 2 years ago Finished Submit report Contest is not active Program info Hackers 143 Reports 0 All Scope Focus Area Program Rules Scope Search targets In scope Target │ Type │ Severity *.avalabs.org Copy Web │ Critical *.avax.network Copy Web │ Critical *.avax-test.network Copy Web │ Critical api.avax.network Copy API │ Critical api.avax-test.network Copy API │ Critical *.avax-dev.network Copy Web │ Critical Show all targets Out of scope Out of scope Target │ Type │ Severity chat.avax.network Copy Web │ None docs.avax.network Copy Web │ None chat.avalabs.org Copy Web │ None buy.avax.network Copy Web │ None *.snowtrace.io Copy Web │ None community.avax.network Copy Web │ None Show all targets Focus Area In-Scope Vulnerabilities Unauthorized remote code execution Domain takeover Injection attacks Leaked secrets or sensitive information Account takeover Access control flaws Other vulnerability with a clear potential loss Out-of-Scope Vulnerabilities Any Denial-of-Service/Spam Attack of any API Vulnerabilities in third-party applications Unexploitable theoretical or best practices concerns Recently (less than 30 days) disclosed 0day vulnerabilities Vulnerabilities affecting users of outdated browsers or platforms Social engineering, spam, phishing, physical, or other fraud activities Most brute-forcing issues without clear impact Non-sensitive Information Disclosure Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking Self-XSS that cannot be used to exploit other users Missing cookie flags on non-sensitive cookies CSRF on unauthenticated endpoints OPTIONS/TRACE HTTP method enabled Host header issues without proof-of-concept demonstrating the vulnerability Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Any attacks requiring physical access to a user's device CSP issues unless exploitable with POC Program Rules Only reports of new, unknown vulnerabilities are eligible for a reward. A vulnerability is known (i.e. a duplicate) if it’s already been reported externally or discovered internally. Vulnerabilities already publicly disclosed will not be eligible for a reward. After reporting, details of a vulnerability may only be made public with expressed authorization from Ava Labs. Avoid using web application scanners for automatic vulnerability searching which generates massive traffic Do not intentionally exploit any vulnerabilities you found: Avoid causing damage or restrict the availability of products, services or infrastructure Don’t access or modify user data you do not own, localize all tests to your accounts Perform testing only within the scope Intimidation, threats against Ava Labs team members and community, whether actual or simulated, are strictly forbidden Social engineering (including phishing) targeting Ava Labs team members and community is strictly forbidden Physical intrusion attempts targeting Ava Labs' property or data centers is strictly forbidden. In case you find chain vulnerabilities you’ll be eligible for the reward based on overall severity. You are responsible for staying within your local laws. Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or Ava Labs security team member. We strive to maintain a healthy relationship with the security research community and base our report evaluation on industry norms and logical reasoning. However, in case of any disputes, our decision is final. Live since 30 Mar 2021 Published date 30 Mar 2021 Last updated 25 May 2026 Range of bounty $100 - $10,000 Severity Critical $5,000 - $10,000 High $1,000 - $5,000 Medium $500 - $1,000 Low $100 - $500 Web blockchain smart contract df @df75421e8167c9ea6501df8 1 @abhhithehacker Verified 2 sa @savik 3 @mrvincere Verified 4 @abd-4fg KYC 5 Response type Business days First Response 3d Triage Time 5d Reward Time 14d Resolution Time 30d