BitGo Mobile Apps Bug Bounty Engagement

Description

BitGo provides the most secure and scalable solutions for the digital asset economy, offering regulated custody, borrowing and lending, and core infrastructure to investors and builders alike. Founded in 2013, the early days of crypto, BitGo pioneered the multi-signature wallet and later built TSS to improve upon other companies’ MPC offerings. Between multi-sig and TSS, BitGo offers the safest technology on the market and safeguards over 600 tokens across a wide variety of blockchains. Over the years, BitGo has expanded from offering wallets into providing a full-suite solution that lets clients hold assets safely and then put them to work. Today, BitGo is the leader in digital asset security, custody, and liquidity, providing the operational backbone for more than 700 institutional clients in over 50 countries — a list that includes many regulated entities and the world’s top cryptocurrency exchanges and platforms. BitGo also processes approximately 20% of all global Bitcoin transactions by value. This bug bounty program targets the pending approval workflow in BitGo’s mobile application. In organizational crypto operations, sensitive actions require review and approval by multiple parties before execution in production. These include Transactions, User management, Policy updates. The mobile app enables approvers to review and take action on these pending approvals directly from their devices. We are looking for passionate and driven researchers who can help us keep our platform secure and join us on our mission. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of BitGo not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to BitGo, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation. Engagement Guidelines You are testing in a production environment. Do not attempt to access any accounts that you do not own. Report Guidelines Reports must contain a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward. Do not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained. We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected. Access/Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Traffic Identification Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Bugcrowd- Focus Areas Trusted Device Management Passkey creation and usage 2FA + TOTP addition and usage Excluded Submission Types P5 vulnerabilities Availability/volumetric testing e.g.: DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing flooding ALL forms of social Engineering N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days have gone by e.g: N-day released on January 1st, we would consider it in-scope on January 15th. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

In Scope (in scope)

Target Description Our mobile applications play a critical role in enabling seamless user interactions. They are designed to support a wide range of functionalities, ensuring that users can perform essential tasks anytime, anywhere. BitGo Verify Primary Supported Testing Regions iOS: United States, Singapore Android: United States, Singapore, and EU regions including Poland BitGo Platform Primary Supported Testing Regions iOS: All regions except India, Ukraine, Russia, Belarus, and Afghanistan Android: All regions