- Top reward
- $3,000
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $3,000
- for critical bugs, from $250.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Paid by crypto
- No identity check to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,000 from $1,000 |
| High |
|
$500 |
| Medium |
|
$250 |
- Top reward
-
$3,000
$1000-$3000 in crypto equivalent if you identified a vulnerability that presented a critical risk *
- Lowest reward
-
$250
$250 in crypto equivalent if you identified a vulnerability that presented a moderate risk *
- Response
-
Within 7 days
Provide us with at least 7 working days to investigate the issue and revert back to you
- Safe harbor
-
Partial
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing
- Hall of fame
-
Yes
Recognize your contribution on Etherscan.io (list below for the last 50 contributors)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 2 excluded.
Domains 2
- etherscan (etherscan.io)
- etherscan.io
Products and areas 1
- explorers under EaaS ( https://etherscan.io/explorer-as-a-service-eaas )
Out of scope (2)
- applications or systems not listed in the ‘Scope’ section
- third-party applications or services
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Etherscan's policy. "We" in these lines means the program, not this site.
While testing
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing
-
Use the identified communication channels to report vulnerability information to us
-
Report vulnerabilities as soon as you discover it, but keep it confidential between yourself and Etherscan until we’ve resolve the issue
-
Provide us with at least 7 working days to investigate the issue and revert back to you
-
Researcher will provide us with a wallet address based on the reported explorer for the payout within 7 days after we have resolved the issue.
Not accepted
-
Visual typos, spelling mistakes, etc
-
Findings derived primarily from social engineering (e.g. phishing, etc)
-
UI/UX bugs, Data entry errors, spelling mistakes, typos, etc
-
Network level Denial of Service (DoS/DDoS) vulnerabilities
-
Certificates/TLS/SSL related issues
-
DNS issues (i.e. MX records, SPF records, etc.)
-
Server configuration issues (i.e., open ports, TLS, etc.)
-
Spam or Social Engineering techniques
-
Security bugs in third-party applications or services
-
XSS Exploits that do not pose a security risk to 'other' users (Self-XSS)
-
Login/Logout CSRF-XSS
-
https/ssl or server-info disclosure related issues
-
https Mixed Content Scripts
-
Brute Force attacks
-
Best practices concerns
-
Recently (less than 30 days) disclosed 0day vulnerabilities
-
Username/email enumeration via Login/Forgot Password Page error messages
-
Missing HTTP security headers
-
Weak password policy
-
HTML injection
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-47035 | RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct unauthorized transfer operations. | High 7.5 | 19 Jan 2024 |