- Top reward
- $50,000
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 4
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $50,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$50,000 from $5,000 |
| High |
|
$4,000 from $2,500 |
| Medium |
|
$2,000 from $1,000 |
| Low |
|
$500 from $250 |
- Response
-
Within 2 days
| First Response | 2 days |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test.
Source code 6
- https://github.com/Chia-Network/chia-blockchain Critical
- https://github.com/Chia-Network/chia-blockchain-gui Critical
- https://github.com/Chia-Network/chiapos Critical
- https://github.com/Chia-Network/chia_rs Critical
- https://github.com/Chia-Network/chiavdf Critical
- https://github.com/Chia-Network/clvm_rs Critical
Web 2
- api.vault.chiatest.net Critical
- https://vault.chiatest.net Critical
iOS apps 1
- https://apps.apple.com/app/chia-signer/id6504493785 Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Chia Network (via HackerOne)'s policy.
While testing
-
please ensure all testing is done against these testnets and not mainnet.
-
You must be the first reporter of the vulnerability.
-
In most cases, a working proof of concept is required for report acceptance.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-3194 | A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been published and may be used. T | Low 1.1 | 25 Feb 2026 |
| CVE-2026-3192 | A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the component RPC Credential Handler. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has | Low 2.9 | 25 Feb 2026 |
| CVE-2026-3193 | A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separat | Low 1.3 | 25 Feb 2026 |
| CVE-2022-36447 | An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. T | High 7.5 | 29 Jul 2022 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
No technology is perfect and Chia Network believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!
Response Targets
Chia Network will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 2 days |
| Time to Bounty | 14 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
- Follow HackerOne's disclosure guidelines.
- We currently don't disclose reports marked as Informative.
Eligibility
- You must be the first reporter of the vulnerability.
- The vulnerability must demonstrate security impact.
- In most cases, a working proof of concept is required for report acceptance.
- If a proof of concept is not provided, nor sufficient supporting documentation for Chia engineers to feasibly recreate and evaluate the issue, the report may not be accepted.
- Report quality for acceptance will be at the discretion of Chia's HackerOne program.
Access
- Information on how to install and test on these applications can be found on their page's wiki's (that can be found in the linked GitHub repos).
- The GitHub repos include instructions on how to point the local services at testnet10 and testnet11, please ensure all testing is done against these testnets and not mainnet.
Safe Harbor
When conducting vulnerability research according to this policy, we consider this research to be:
- Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
- Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
- Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
- You are expected, as always, to comply with all applicable laws.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.