- Top reward
- $50,000
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 1
- Last change
At a glance
What to know before you start testing.
- Pays up to $50,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$50,000 |
| High |
|
$15,000 |
| Medium |
|
$1,250 |
| Low |
|
$500 |
Scope
13 assets you may test, 22 excluded.
Web 5
- api-wallet.web3auth.io Critical
- metamask.io Critical
- signature-insights.api.cx.metamask.io Critical
- snaps.metamask.io Critical
- wallet.web3auth.io Critical
Android apps 1
- io.metamask No bounty
iOS apps 1
- io.metamask.Metamask Critical
Products and areas 6
- https://metamask.github.io/phishing-warning/<vX.Y.Z> Critical
- MetaMask Browser Extension No bounty
- MetaMask SDK No bounty
- mUSD Stablecoin No bounty
- Snaps No bounty
- Third Party Snaps No bounty
Out of scope (22)
- Core Tier Assets
- https://metamask.github.io/
- https://www.npmjs.com/search?q=%40metamask
- Message signing snap
- Metamask Flask Extension
- Non-Core Tier Assets
- Wallet Tier Assets
- https://github.com/Web3Auth/web3auth-web
- Snaps Development Packages
- api-dashboard.web3auth.io
- card.metamask.io
- community.metamask.io
- dashboard.web3auth.io
- developer.metamask.io
- https://mmi-support.metamask.io
- https://support.metamask.io
- https://user-storage.api.cx.metamask.io
- permissionless.snaps.metamask.io
- portfolio.metamask.io (app.metamask.io)
- travel.metamask.io
- *.api.cx.metamask.io
- *.metamask.io
Changes
Tracked since 12 Nov 2026. Last checked 1 hour ago.
-
Paused
Paused. Not accepting reports right now.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-32969 | MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue. | Medium 5.9 | 29 Jun 2022 |