Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Obol Labs

Bug bounty on Self-hosted obol.org

Accepting reports
Go to program Website
Top reward
$25,000
Top severity paid
Critical
Assets in scope
19
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $25,000
for critical bugs, from $125.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $25,000
High $2,500
Medium $500
Low $125
Top reward
$25,000 Critical Vulnerabilities: Up to $25,000
Lowest reward
$125 Low Vulnerabilities: Up to $125
Safe harbor
Partial Obol Labs will not pursue legal action against researchers reporting vulnerabilities in good faith, but reserves the right to respond to violations of this policy.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

19 assets you may test, 14 excluded.

APIs 4

  • api.obol.tech
  • Obol DV Launchpad and Public API
  • Obol public API
  • the Obol public API

Smart contracts 3

  • Legacy Obol Splits contracts (OWR — Optimistic Withdrawal Recipient — and 0xSplits-based contracts deployed before the OVM)
  • The OBOL token contract ( 0x0B010000b7624eb9B3DfBC279673C76E9D29D5F7 )
  • The Obol Validator Manager (OVM) smart contracts

Domains 1

  • obol.org

Source code 1

  • https://github.com/ObolNetwork/charon

Web 1

  • The Obol DV Launchpad

Products and areas 9

  • 0x2c26B5A373294CaccBd3DE817D9B7C6aea7De584
  • Charon
  • Charon's cluster lifecycle commands, including the DKG ceremony
  • Charon the DV Middleware Client
  • Obol DV Launchpad
  • Obol Labs hosted Public Relay Infrastructure
  • Obol-operated public relay infrastructure
  • Obol Splits Contracts
  • the DV middleware client
Out of scope (14)
  • Experimental charon alpha commands ( charon alpha edit and related subcommands).
  • Non-security related UX/UI issues
  • Non-security UX/UI issues.
  • Physical security breaches
  • Rate limiting and similar non-security UX issues.
  • Rate Limiting (Non-critical issues)
  • Social engineering
  • Social engineering of Obol staff or community members.
  • The obol.org static website and Obol's internal corporate infrastructure.
  • The Obol Stack and its in-cluster components (Hermes, OpenClaw, x402 facilitator, Cloudflared, eRPC, etc.).
  • The Obol static website or the Obol infrastructure
  • The operational security of node operators running Obol software (operators are responsible for their own host security).
  • Third-party application or library vulnerabilities (please report upstream).
  • Third-party application vulnerabilities

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Obol Labs's policy.

While testing

  • Submitted bugs must not have been previously disclosed publicly.
  • Only first reports of vulnerabilities will be considered for rewards; previously reported or known vulnerabilities are ineligible.
  • Submissions must include a reproducible proof of concept: for example a Go test or patch against a tagged Charon release, a Foundry fork test for smart contracts, or a script against a local devnet.
  • Submissions must state which known issue is closest to the finding and why it differs.
  • Any testing on mainnet or public testnet deployed code; all testing must be done on local forks.
  • Any testing involving pricing oracles or third-party smart contracts.
  • Phishing or other social engineering attacks against Obol employees, contractors, partners, or community members.
  • Any testing against third-party systems, applications, browser extensions, or websites (including SSO providers and advertising networks).
  • Denial-of-service attacks executed against Obol-operated infrastructure or the deployed contracts.
  • Automated testing of services that generates significant traffic.

Not accepted

  • Social engineering of Obol staff or community members.
  • Rate limiting and similar non-security UX issues.
  • Physical security breaches.
  • Non-security UX/UI issues.
  • Third-party application or library vulnerabilities (please report upstream).
  • The obol.org static website and Obol's internal corporate infrastructure.
  • The operational security of node operators running Obol software (operators are responsible for their own host security).
  • The Obol Stack and its in-cluster components (Hermes, OpenClaw, x402 facilitator, Cloudflared, eRPC, etc.).
  • Experimental charon alpha commands ( charon alpha edit and related subcommands).
  • Legacy lock versions : missing signatures or weaker checks in lock and definition formats before v1.10.0.
  • Fee-recipient warn-only : Charon warning, rather than rejecting, when a proposal's fee recipient does not match the cluster's.
  • Peer and relay resource exhaustion : memory, CPU or bandwidth exhaustion that requires being a cluster peer or a configured relay.
  • Operator-signature trust model on definitions : creator-signed or solo-created definitions, and operators approving a definition they were shown.
  • Split-address prediction in the SDK : predicting or pre-computing split contract addresses.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.