Blofin Crypto Managed Bug Bounty Engagement
By BloFin Bug bounty on Bugcrowd blofin.com
- Top reward
- $4,000
- Top severity paid
- Critical
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $4,000
- for critical bugs, from $50.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$4,000 from $2,000 |
| High |
|
$2,000 from $1,000 |
| Medium |
|
$1,000 from $200 |
| Low |
|
$200 from $50 |
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $4,000
Scope
7 assets you may test.
Android apps 2
- https://play.google.com/store/apps/details?id=com.blofin.android
- https://play.google.com/store/apps/details?id=com.blofin.wallet.wallet
iOS apps 2
- https://apps.apple.com/tt/app/blofin/id1616804346
- https://apps.apple.com/us/app/blofin-wallet/id6753210919
Web 2
- https://blofin.com
- https://wallet.blofin.com/en
Wildcard domains 1
- *.blofin.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Blofin Crypto Managed Bug Bounty Engagement (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Testing is only authorized on the targets listed as in scope.
-
To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address.
Not accepted
-
Vulnerabilities in third-party applications
-
Vulnerabilities requiring any third-party apps (including malware) to be installed in the victims device
-
Other browser sessions not logging out immediately upon a change in password/ setup of 2FA
-
Vulnerabilities affecting users of outdated browsers or platforms
-
Social engineering, phishing, physical, or other fraud activities
-
Publicly accessible login panels without proof of exploitation
-
Issues related to unsafe SSL/TLS cipher suites or protocol version
-
Use of known vulnerable libraries without actual proof of concept
-
Email verification deficiencies, expiration of password reset links, and password complexity policies
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Missing HttpOnly or Secure flags on cookies
-
Exposure of internal IP address or domains
-
DNS Hijacking
-
Community Broken Link Hijacking
-
Email or mobile enumeration (E.g. the ability to identify emails via password reset)
-
Information disclosure with minimal security impact (E.g. stack traces, path disclosure, directory listings, logs)
-
Internally known issues, duplicate issues, or issues which have already been made public
-
Tab-nabbing
-
Vulnerabilities related to auto-fill web forms
-
Content spoofing
-
Cache-control related issues
-
Missing security headers that do not lead to direct exploitation
-
CSRF with negligible security impact (E.g. adding to favourites, adding to cart, subscribing to a non critical feature)
-
Reports from automated tools or scans
-
Any activity (like DoS/DDoS) that disrupts our services
Summarised with AI from the program policy on Bugcrowd, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 minute ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://wallet.blofin.com/en
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
At BloFin, we are committed to maintaining the highest security standards for our cryptocurrency exchange platform. To further enhance our security posture, we invite security researchers and community members to participate in our Bug Bounty Program. This program is focused on identifying and resolving security vulnerabilities to protect our users and platform. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of Blofin not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Blofin, you can report it to this engagement. However, be aware that such reports will be ineligible for rewards or points-based compensation. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Bug Classifications Severity │ Description Critical │ Can read or modify Sensitive Data in a system, execute arbitrary code on the system, or exfiltrate digital or fiat currency in some way High │ SQL injection to system (backend loophole reports would be downrated, while submission in * pack uprated if appropriate) Unauthorized access to sensitive data, including bypassing authentication * to access the backend, weak backend password, and SSRF obtaining considerable sensitive intranet information Serious logical design flaws and process flaws (user login vulnerabilities, batch password modification, logic flaws in core business—except verification code blasting) Local arbitrary code execution (locally exploitable or native code execution caused by logic issues) Other vulnerabilities affecting users on a large scale (e.g., stored XSS that propagates automatically or yields admin authentication info) Medium │ Vulnerabilities requiring interaction to affect users (e.g., stored XSS on general pages, CSRF involving core business) Ordinary unauthorized operations (bypassing restrictions, modifying user info, performing user actions, etc.) Vulnerabilities caused by successful blasting of sensitive system operations (arbitrary login, arbitrary password retrieval due to verification code logic) Leakage of locally stored sensitive authentication key information that can be effectively used Subdomain takeover Low │ Local Denial of Service vulnerabilities (client-side parsing crashes, network protocol crashes, Android component permission exposure, common permission issues) General information leakage (web path traversal, system path traversal, directory browsing, etc.) Reflected XSS (including DOM XSS / Flash XSS) Normal CSRF URL redirection vulnerability Out of Scope: The following items are considered out of scope for the web portion of the scope: Vulnerabilities in third-party applications Vulnerabilities requiring any third-party apps (including malware) to be installed in the victims device Other browser sessions not logging out immediately upon a change in password/ setup of 2FA Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis Vulnerabilities affecting users of outdated browsers or platforms Social engineering, phishing, physical, or other fraud activities Publicly accessible login panels without proof of exploitation Issues related to unsafe SSL/TLS cipher suites or protocol version Use of known vulnerable libraries without actual proof of concept Email verification deficiencies, expiration of password reset links, and password complexity policies Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) Missing HttpOnly or Secure flags on cookies Exposure of internal IP address or domains DNS Hijacking Community Broken Link Hijacking Email or mobile enumeration (E.g. the ability to identify emails via password reset) Information disclosure with minimal security impact (E.g. stack traces, path disclosure, directory listings, logs) Internally known issues, duplicate issues, or issues which have already been made public Tab-nabbing Vulnerabilities related to auto-fill web forms Content spoofing Cache-control related issues Missing security headers that do not lead to direct exploitation CSRF with negligible security impact (E.g. adding to favourites, adding to cart, subscribing to a non critical feature) Reports from automated tools or scans Any activity (like DoS/DDoS) that disrupts our services The following content is considered out of scope for the mobile portion of the scope: Vulnerabilities that require root/jailbreak Installation Path Permissions Vulnerabilities that require physical access to a users device Vulnerabilities requiring extensive user interaction Exposure of non-sensitive data on the device Reports from static analysis of the binary without PoC that impacts business logic Lack of obfuscation/binary protection/root(jailbreak) detection Bypass certificate pinning on rooted devices Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries Sensitive data in URLs/request bodies when protected by TLS Path disclosure in the binary OAuth & app secret hard-coded/recoverable in IPA, APK Reports from automated tools or scans Sensitive information retained as plaintext in the device's memory Any kind of sensitive data stored in-app private directory Runtime hacking exploits using tools like but not limited to Frida, Xposed,Appmon (exploits only possible in a jailbroken environment) Shared links leaked through the system clipboard Exposure of API keys with no security impact (Google Maps API keys etc.) Everything included in the OUT OF SCOPE - WEB section