Bybit Fintech Ltd

Introduction

Bybit is a cryptocurrency exchange established in March 2018 to offer a professional platform where crypto traders can find an ultra-fast matching engine, excellent customer service and multilingual community support. The company provides innovative online spot and derivatives trading services, mining and staking products, as well as API support, to retail and institutional clients around the world, and strives to be the most reliable exchange for the emerging digital asset class.

No technology is perfect and Bybit believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. Bybit looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Response Targets

Bybit Fintech Ltd will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• Avoid employing automated scanning tools, as submissions identified through such means cannot be accepted.
• Avoid negatively impacting or disruptive actions that may affect the availability of our services (e.g. DoS/DDoS)

Test Plan

• If you are interested in testing our asset-related features, but lack the necessary assets to conduct testing, you can register accounts and apply test tokens in the asset dashboard via https://testnet.bybit.com. (*Please note that Testnet utilizes test coins that hold no real value. To ensure our users enjoy an optimal experience with our products, we've opted not to impose stringent 2FA restrictions. Consequently, reports of bypassing 2FA on the Testnet will not be accepted).
• Sign Up using your HackerOne email alias
• Need to contact Bybit? Feel free to contact us at [email protected]

Vulnerability Severity Classification

Bybit classifies reported vulnerabilities into four severity levels. Our assessment primarily references the CVSS v3.1 scoring framework, combined with the type of vulnerability, the affected asset, actual exploitability, and the potential business and user impact to determine the final severity rating. The examples listed below are not exhaustive. Vulnerabilities not explicitly covered will be assessed using the same criteria and assigned a severity level based on their actual impact.

Critical

Vulnerabilities that can directly compromise critical systems, cause large-scale user data breaches, or cause significant financial losses to the platform without requiring any additional prerequisites for exploitation.

Examples include but are not limited to:

1. Direct Takeover of Core Servers or Critical Client Applications: Vulnerabilities that enable direct takeover of core servers or large-scale compromise of critical client applications, including but not limited to Remote Code Execution (RCE), arbitrary command execution, WebShell access through file upload vulnerabilities, SQL injection enabling direct system-level command execution, remote kernel code execution, or other vulnerabilities enabling remote code execution on core production systems or critical client applications.
2. Directly Causing Severe Sensitive Information Disclosure: Vulnerabilities that enable large-scale bulk extraction of highly sensitive information, including SQL injection in core databases (e.g., funds/assets, identity, or trading data), and API security vulnerabilities resulting in the bulk disclosure of highly sensitive user information, such as KYC information, wallet private keys, wallet seed phrases, or trading API keys.
3. Critical Logic and Process Flaws: Severe business logic or process design vulnerabilities that can be directly exploited to compromise arbitrary user accounts or core financial flows, including but not limited to arbitrary account login, arbitrary password modification, unauthorized spending from arbitrary accounts, and critical design flaws in core payment or transaction fund flows.
4. Mass Account Takeover: Vulnerabilities that enable direct, systematic, and large-scale takeover of a substantial portion of user accounts, typically affecting more than 50% of users, without requiring user interaction, victim participation, or other significant prerequisites.
5. Directly Causing Significant Financial Loss: Vulnerabilities that can be directly exploited to steal or manipulate the platform’s funds or digital assets, resulting in large-scale or high-value financial losses.

High

Vulnerabilities that can cause significant security, financial, or operational impact, including system compromise, sensitive information disclosure, financial exploitation, or large-scale user or business impact.

Examples include but are not limited to:

1. Direct Takeover of General Systems: Vulnerabilities that can be directly exploited to obtain system-level privileges or full control of general-purpose servers, including but not limited to command injection, Remote Command Execution (RCE), arbitrary code execution, file upload leading to WebShell access, SQL injection enabling direct system-level command execution.
2. Sensitive Information Disclosure: Exposure of highly sensitive information from core production environments, including core business source code, production database configuration files, or core authentication credentials, where the disclosed information can be successfully leveraged to obtain unauthorized access to enterprise data or protected resources, resulting in a demonstrable security impact.
3. Business Logic Flaw Leading to Arbitrage Risk: Business logic vulnerabilities that can be repeatedly or at scale exploited to generate improper financial gains, resulting in significant financial losses to the platform through arbitrage.
4. Other Vulnerabilities with Large-Scale User Impact: Vulnerabilities that can be exploited at scale to affect a large number of users or critical user operations, including but not limited to self-replicating stored XSS worms on critical user-facing pages and CSRF vulnerabilities that enable unauthorized trading, fund transfers, or password changes.
5. Two-Factor Authentication (2FA) bypass: Circumventing 2FA on production systems through logic flaws, race conditions, or other means that weaken account security for targeted users.

Medium

Vulnerabilities that can cause moderate security, financial, or operational impact, including limited-scope information disclosure, privilege escalation, business logic flaws, or vulnerabilities requiring user interaction or other prerequisites.

Examples include but are not limited to:

1. User-Interaction-Dependent Vulnerabilities: Vulnerabilities in core business systems that require victim interaction to exploit, including persistent (stored) XSS, reflected XSS (including reflected DOM-based XSS), and CSRF targeting sensitive business operations.(Note: XSS or CSRF does not inherently imply arbitrary session hijacking or account takeover. Actual impact should be evaluated in the context of existing security controls, including 2FA requirements for sensitive operations, risk control mechanisms for detecting anomalous behavior, and the likelihood of users interacting with malicious content. For reports claiming large-scale account takeover or financial theft, please provide a complete proof of concept (PoC) and a detailed attack chain to demonstrate the claimed impact.)
2. General Information Disclosure: Disclosure of non-critical or limited-sensitivity information, including SQL injection without access to sensitive data and plaintext exposure of usernames, passwords, or similar information in general business source code or system logs.
3. Privilege Escalation and Unauthorized Access: Vulnerabilities that enable unauthorized access to privileged functions, resources, or sensitive data, including horizontal or vertical privilege escalation, IDOR, access control flaws, and unauthorized administrative, order, or financial operations.
4. General Logic and Process Flaws: Business logic or process flaws that enable unintended or unauthorized business actions, including but not limited to abuse of SMS verification code interfaces causing resource consumption, and weaknesses in login or password reset verification logic.

Low

Vulnerabilities that cause limited security impact, typically involving low-sensitivity information disclosure, non-core system vulnerabilities, or requiring additional exploitation conditions or user interaction.

Examples include but are not limited to:

1. User-Interaction-Dependent Vulnerabilities: XSS vulnerabilities in non-core or peripheral business systems that require victim interaction to exploit, including persistent (stored) XSS, reflected XSS, and reflected DOM-based XSS.
2. Open Redirect (with Demonstrated Impact): Open redirect vulnerabilities that can be meaningfully chained with other vulnerabilities or contribute to realistic phishing attacks.
3. Cache Poisoning : Cache poisoning vulnerabilities. Severity is assessed based on the actual impact, exploitation requirements, reproducibility, and persistence of the vulnerability.
4. Minor Information Disclosure: Low-sensitivity information disclosure, including but not limited to path disclosure, exposed SVN metadata or repositories, and PHPInfo pages.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider ： (1) attack scenario / exploitability (2) security impact of the bug

The following issues are considered out of scope:

• Any activity that could lead to the disruption of our service (DoS, DDoS).
• Social engineering of our employees or contractors, unless explicitly authorized.
• Attacks against our physical facilities, unless explicitly authorized.
• Attacks requiring physical access to a users’ device, unless the device is in-scope and explicitly hardened against physical access.
• Attacks requiring disabling Man In The Middle (MITM) protections.
• Attacks only affecting obsolete browsers or operating systems.
• Missing best practices (SSL/TLS configuration, Content Security Policies, cookie flags, tabnabbing, autocomplete attribute, email SPF/DKIM/DMARC records), unless a significant impact can be demonstrated.
• Clickjacking or Cross-Site Request Forgery (CSRF) on unauthenticated pages / forms with no sensitive actions.
• Open redirects, unless a significant impact can be demonstrated.
• Self-exploitation (self XSS, self denial-of-service, etc.), unless a method to attack a different user can be demonstrated.
• Content spoofing, text injection and CSV injection, unless a significant impact can be demonstrated.
• OpenAPI CORS Misconfiguration: CORS misconfigurations in OpenAPI endpoints are generally considered out of scope unless the reporter can demonstrate a genuine, verifiable security risk and actual impact.
• Software version disclosure / Banner identification issues / Descriptive error messages or stack traces.
• Issues that require unlikely user interaction by the victim.
• Any attack that requires a user to interact with contract from an attacker controlled website
• Chain specific vulnerabilities are excluded, (e.g. EVM or Solana runtime issues)
• Integrated Dapp vulnerabilities are excluded (e.g. Uniswap、Curve、GMX、1inch)
• Theoretical vulnerabilities without a working proof of concept.
• Reports from automated scanning tools without manual validation and demonstrated impact.

Severity Downgrade Conditions

• Unstable or Unreproducible Vulnerabilities: Vulnerabilities that cannot be consistently reproduced or reliably exploited, or where a stable and repeatable exploitation path cannot be demonstrated under the reported conditions.
• Limited or Short-Lived Cache Poisoning: Cache poisoning vulnerabilities where the poisoned content has a limited distribution, affects only a subset of cache nodes or users (e.g., specific regional CDN nodes), persists only for a short period, or can be readily overwritten, refreshed, or invalidated through normal cache behavior.
• Limited Impact Scope: The vulnerability affects only a small number of users or specific users, or applies only to systems with a small user base or legacy systems containing low-sensitivity data.
• High-Complexity Brute-Force: Vulnerabilities requiring impractical brute-force attempts, such as targeting 6-digit or longer verification codes, passwords, or authentication credentials.
• Risk Control Mitigation: Exploitation attempts are detected and blocked by the risk control system, preventing successful exploitation.
• AI-Discovered Vulnerabilities Without Human Verification: Vulnerabilities identified solely by AI without prior human verification. If the reported vulnerability is confirmed to be nonexistent after three reproduction attempts, the finding will be marked as Not Applicable (N/A), and the reporter's reputation score will be reduced by 5 points. If the vulnerability is successfully reproduced, its severity rating will be downgraded by default, with the extent of the downgrade determined by the actual impact and exploitability demonstrated during validation.
• Social Media Handle Squatting: Social media handle squatting risks are considered Informational and are not eligible for a higher severity rating.
• Insufficient Vulnerability Report Details: Reports containing only brief textual descriptions or code snippets, without sufficient details to verify the vulnerability, may receive a lower rating or reward. Reporters are encouraged to include a clear vulnerability description, exploitation requirements, detailed reproduction steps, screenshots, and demonstration videos where applicable. High-quality reports may receive bonus points in addition to the base vulnerability score.

Safe Harbor

Gold Standard Safe Harbor applies to this program

Thank you for helping keep Bybit Fintech Ltd and our users safe!