- Top reward
- $1,000,000
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $1,000,000
- for critical bugs.
- Report on Cantina
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Payment
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Cantina lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,000,000 from $150,000 |
| High |
|
$150,000 from $50,000 |
| Medium |
|
$50,000 from $5,000 |
| Low |
|
$5,000 from $50 |
- Safe harbor
-
Partial
Participation does not constitute an admission or concession of fault or liability by dYdX.
Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test.
Source code 11
- https://github.com/dydxprotocol/v4-abacus
- https://github.com/dydxprotocol/v4-chain/tree/main/indexer
- https://github.com/dydxprotocol/v4-chain/tree/main/protocol
- https://github.com/dydxprotocol/v4-clients
- https://github.com/dydxprotocol/v4-documentation
- https://github.com/dydxprotocol/v4-infrastructure
- https://github.com/dydxprotocol/v4-latency-scripts
- https://github.com/dydxprotocol/v4-localization
- https://github.com/dydxprotocol/v4-native-mobile
- https://github.com/dydxprotocol/v4-testnets
- https://github.com/dydxprotocol/v4-web
Rules
What the policy asks of you, and the bug types it won't reward, quoted from dYdX Bug Bounty (via Cantina)'s policy.
While testing
-
Testing on mainnet in any way that exploits, drains, or disrupts the network or its users.
-
Public disclosure of any vulnerability prior to dYdX issuing a fix and granting written permission to disclose.
-
Automated scanning or testing that generates excessive traffic against dYdX infrastructure.
-
Accessing, modifying, or destroying data that does not belong to you, including any personal or sensitive information.
-
Submitting duplicates of vulnerabilities that have already been reported or paid.
-
Conditioning the disclosure of a vulnerability on payment, demanding compensation outside the published reward structure, or making any threats.
-
Exploiting a vulnerability for personal benefit beyond what is necessary to demonstrate it.
-
Disclosure of any vulnerability must be made via the Cantina platform within 24 hours of discovery.
-
Vulnerability details must not be shared with third parties before dYdX has confirmed, fixed, and approved disclosure.
Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
https://github.com/dydxprotocol/v4-chain
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from cantina.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
dYdX Bug Bounty @ dydx Live Cantina-Triaged Maximum reward $1,000,000 Severity Max. Reward Critical $1,000,000 High $150,000 Medium $50,000 Low $5,000 Deposit required $30 Findings submitted 1,234 Start date 8 May 2026 KYC Required to join Please sign in as a researcher to join the bounty. Log in Instructions Scope dYdX Chain (dYdX v4) is open source software for a decentralized perpetual futures protocol built as an application-specific blockchain using the Cosmos SDK and CometBFT. It runs a fully on-chain orderbook and matching engine, with off-chain Indexer infrastructure feeding the trading frontend. The protocol supports cross-margined perpetual markets, governance, and staking, operated by a network of independent validators. More information is available at https://github.com/dydxprotocol/v4-chain . This program covers the protocol layer, the indexer, the web client, and the official client SDKs. See the in-scope asset groups for details and per-severity rewards. Severity Definitions Severity is assessed based on impact to the network, user funds, and the dYdX Site. Examples by level: Critical : Vulnerabilities resulting in significant loss or theft of user funds, large-scale insolvency of the protocol, permanent freezing of funds, or unauthorized minting/printing of value. Extraordinary finds in this category may qualify for elevated rewards ($150k-1m or higher at dYdX's sole discretion). High : Network-level downtime or liveness failures (e.g., halting block production, crashing the chain, preventing settlement), or material degradation of the matching engine ($50k-150k). Medium : Failures in non-core products such as staking or governance that do not result in fund loss but degrade user experience or protocol guarantees ($5k-50k). Low : Display, event-parsing, or Indexer-side issues that mislead users or clients but do not affect on-chain state or funds ($50-5k). In addition to the above definitions, we will also use the Cantina Bug Bounty Severity Classification Framework to determine severity. Prohibited Actions Testing on mainnet in any way that exploits, drains, or disrupts the network or its users. Public disclosure of any vulnerability prior to dYdX issuing a fix and granting written permission to disclose. Automated scanning or testing that generates excessive traffic against dYdX infrastructure. Accessing, modifying, or destroying data that does not belong to you, including any personal or sensitive information. Submitting duplicates of vulnerabilities that have already been reported or paid. Conditioning the disclosure of a vulnerability on payment, demanding compensation outside the published reward structure, or making any threats. Exploiting a vulnerability for personal benefit beyond what is necessary to demonstrate it. Eligibility You must be of legal age in your jurisdiction and have the capacity to be bound by these terms. You must be the first reporter of the vulnerability via the Cantina platform. You must provide sufficient detail (reproduction steps and, where possible, a proof of concept) for dYdX to reproduce and remediate the issue. Current and former employees, vendors, contractors, and agents of dYdX (within the prior 6 months) are not eligible. Individuals or entities subject to U.S. or other applicable sanctions (including OFAC-listed persons) are not eligible. Anyone who has previously exploited or publicly disclosed the vulnerability is not eligible. Tax forms and identity verification may be required prior to payment. Other Terms Disclosure of any vulnerability must be made via the Cantina platform within 24 hours of discovery. Vulnerability details must not be shared with third parties before dYdX has confirmed, fixed, and approved disclosure. The categorization and amount of any payment is determined at the sole discretion of dYdX. dYdX reserves the right to amend, suspend, or terminate this program at any time. Participation does not constitute an admission or concession of fault or liability by dYdX. Reporters are solely responsible for any tax liabilities arising from received rewards. Reporters release dYdX from any claims arising from participation in or payment determinations under this program.