- Top reward
- $5,000,000
- Top severity paid
- Critical
- Assets in scope
- 49
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000,000
- for critical bugs.
- Report on Cantina
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Payment
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Cantina lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000,000 from $250,000 |
| High |
|
$250,000 from $10,000 |
| Medium |
|
$10,000 from $1,000 |
| Low |
|
$1,000 from $10 |
- Safe harbor
-
Partial
No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization.
Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
49 assets you may test.
Smart contracts 48
- All wallets deployed by the scoped factory, both legacy ERC-1967 and beacon-backed.
- https://polygonscan.com/address/0x00000000000Fb5C9ADea0298D729A0CB3823Cc07
- https://polygonscan.com/address/0x000012e0009c84078c4924fba808A41b9f67527f
- https://polygonscan.com/address/0x006F54F7f9A22e0000CC2AB60031000000ae9fEF
- https://polygonscan.com/address/0x0A0a0A0A8B00C51b7D810501b03F230028C04a87
- https://polygonscan.com/address/0x1000008dD9001B968442c1000017eaE6E0dA00Ba
- https://polygonscan.com/address/0x12121212006e4CD160D18e3f00711DA5c3372600
- https://polygonscan.com/address/0x157Ce2d672854c848c9b79C49a8Cc6cc89176a49
- https://polygonscan.com/address/0x200000900045e3B6259600682756002200028933
- https://polygonscan.com/address/0x2957922Eb93258b93368531d39fAcCA3B4dC5854
- https://polygonscan.com/address/0x2F5e3684cb1F318ec51b00Edba38d79Ac2c0aA9d
- https://polygonscan.com/address/0x30000034706C7d8e12009DAB006Be20000c031A8
- https://polygonscan.com/address/0x3A3BD7bb9528E159577F7C2e685CC81A765002E2
- https://polygonscan.com/address/0x4bFb41d5B3570DeFd03C39a9A4D8DE6Bd8B8982E
- https://polygonscan.com/address/0x4D97DCd97eC945f40cF65F87097ACe5EA0476045
- https://polygonscan.com/address/0x528CC05EFac2B0d255e423272187efD41248aBd7
- https://polygonscan.com/address/0x56C79347e95530c01A2FC76E732f9566dA16E113
- https://polygonscan.com/address/0x58CA52ebe0DadfdF531Cde7062e76746de4Db1eB
- https://polygonscan.com/address/0x65070BE91477460D8A7AeEb94ef92fe056C2f2A7
- https://polygonscan.com/address/0x661992aebf6BecF7BA5abB66f6b0Bf62Aa7a2E93
- https://polygonscan.com/address/0x69c47De9D4D3Dad79590d61b9e05918E03775f24
- https://polygonscan.com/address/0x6A9D222616C90FcA5754cd1333cFD9b7fb6a4F74
- https://polygonscan.com/address/0x6dD7B5eA91608c60cd4A1944432cc30eE5A6D1cA
- https://polygonscan.com/address/0x71523d0f655B41E805Cec45b17163f528B59B820
- https://polygonscan.com/address/0x78769D50Be1763ed1CA0D5E878D93f05aabff29e
- https://polygonscan.com/address/0x7A18EDfe055488A3128f01F563e5B479D92ffc3a
- https://polygonscan.com/address/0x7f67327E88c258932D7d8f72950bE0d46975E11D
- https://polygonscan.com/address/0x8Ef9D6d668798b1f363b305D916F30739d2b0419
- https://polygonscan.com/address/0x93070a847efEf7F70739046A929D47a521F5B8ee
- https://polygonscan.com/address/0xa1200000d0002264C9a1698e001292D00E1b00af
- https://polygonscan.com/address/0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b
- https://polygonscan.com/address/0xaB45c5A4B0c941a2F231C04C3f49182e1A254052
- https://polygonscan.com/address/0xADa100874d00e3331D00F2007a9c336a65009718
- https://polygonscan.com/address/0xada100db00ca00073811820692005400218fce1f
- https://polygonscan.com/address/0xAdA200001000ef00D07553cEE7006808F895c6F1
- https://polygonscan.com/address/0xada2005600dec949baf300f4c6120000bdb6eaab
- https://polygonscan.com/address/0xb6F9C7E68A38c21BeDfD873bC5a378236f7ba987
- https://polygonscan.com/address/0xC011a7E12a19f7B1f670d46F03B03f3342E82DFB
- https://polygonscan.com/address/0xc12EC12E0000326890Ca5560dEf5EB5C22b16814
- https://polygonscan.com/address/0xC417fD8E9661c0d2120B64a04Bb3278C17E99DB1
- https://polygonscan.com/address/0xC5d563A36AE78145C45a50134d48A1215220f80a
- https://polygonscan.com/address/0xd91E80cF2E7be2e162c6513ceD06f1dD0dA35296
- https://polygonscan.com/address/0xDCa4af75705dbB50f62437045afF9921947917d2
- https://polygonscan.com/address/0xE111180000d2663C0091e4f400237545B87B996B
- https://polygonscan.com/address/0xe2222d279d744050d28e00520010520000310F59
- https://polygonscan.com/address/0xe3333700cA9d93003F00f0F71f8515005F6c00Aa
- https://polygonscan.com/address/0xebC2459Ec962869ca4c0bd1E06368272732BCb08
- https://polygonscan.com/address/0xf7f27C29e60fe6325beF8dA7F93250353d2e3294
Web 1
- https://polymarket.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Polymarket (via Cantina)'s policy.
While testing
-
No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization.
-
No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.
-
No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue.
-
No Front-Running or MEV Exploitation: Do not use knowledge gained from vulnerability research to front-run transactions, extract MEV, or gain trading advantage on Polymarket or related markets.
-
No Off-Platform Contact: All discussion about a submitted finding must happen on Cantina.
Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 52 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Reward terms
The reward table or payout terms were edited
-
Reward raised
Maximum $5,000,000 → $5,000,000
-
Scope removed
https://polygonscan.com/address/0xb6F9C7E68A38c21BeDfD873bC5a378236f7ba987
-
Scope added
https://polygonscan.com/address/0xf7f27C29e60fe6325beF8dA7F93250353d2e3294
-
Scope added
https://polygonscan.com/address/0x7A18EDfe055488A3128f01F563e5B479D92ffc3a#code
-
Scope added
https://polygonscan.com/address/0x000012e0009c84078c4924fba808A41b9f67527f
-
Scope added
https://polygonscan.com/address/0x8Ef9D6d668798b1f363b305D916F30739d2b0419
-
Scope added
https://polygonscan.com/address/0xc12EC12E0000326890Ca5560dEf5EB5C22b16814
-
Scope added
https://polygonscan.com/address/0x0A0a0A0A8B00C51b7D810501b03F230028C04a87
-
Scope removed
https://polygonscan.com/address/0x5fe0280873f5539da12B6b5b37484E0B0c28Ab14
-
Scope removed
https://polygonscan.com/address/0xBd49A21677Da630fF5Efec52B7309d0Ada685d81
-
Scope removed
https://polygonscan.com/address/0x70545d95653a4a7B1c2F47f6a9383E36EaAA55b2
-
Scope removed
https://polygonscan.com/address/0x822e8A97AF8005073F2f6E88435D692E33ab6082
-
Scope added
https://polygonscan.com/address/0xdca4af75705dbb50f62437045aff9921947917d2
-
Scope removed
https://polygonscan.com/address/0x4bfb41d5b3570defd03c39a9a4d8de6bd8b8982e
-
Scope removed
https://github.com/Polymarket/ctf-exchange-v2
-
Scope removed
https://polygonscan.com/address/0xC5d563A36AE78145C45a50134d48A1215220f80a
-
Scope removed
https://github.com/Polymarket/contract-security
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from cantina.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Polymarket @ polymarket Live Cantina-Triaged Maximum reward $5,000,000 Severity Max. Reward Critical $5,000,000 High $250,000 Medium $10,000 Low $1,000 Deposit required $5 Findings submitted 1,065 Start date 12 Apr 2026 KYC Required to join Please sign in as a researcher to join the bounty. Log in Instructions Scope Introduction Polymarket is the world's largest prediction market. With Polymarket you can bet on the outcome of future events in a wide range of topics, like sports, politics, and pop culture. Get accurate real-time probabilities of the events that matter most to you. Severity and Rewards Vulnerabilities are classified by Impact and Likelihood. The combination determines the severity and guides the reward amount. Risk Classification Matrix Severity Level │ Impact: Critical │ Impact: High │ Impact: Medium │ Impact: Low Likelihood: High │ Critical │ High │ Medium │ Low Likelihood: Medium │ High │ High │ Medium │ Low Likelihood: Low │ Medium │ Medium │ Low │ Informational Impact Definitions Smart Contracts Reward calculation The tier sets the reward ceiling. It does not set severity. If direct theft is possible, the finding is Critical even when the affected contract sits in Tier 2, 3, or 4. For a Critical finding, reward = min(applicable tier ceiling, max(tier Critical minimum, 10% of directly affected funds)). Apply the formula to every tier. Directly affected funds Directly affected funds are assets that the submitted root cause can steal, irreversibly lock, burn, mint without backing, or wrongfully pay under production-reachable conditions before practical remediation. Aggregate repeatable impact across all users and markets reachable through the same root cause. Count balances or approvals only where the proof shows the exploit can exercise them without a separate key compromise or an unrelated victim action. Do not count total protocol TVL solely because the vulnerable contract is reachable. For oracle bugs, count collateral payable by every condition the same root can resolve incorrectly. For ramps and adapters, use demonstrated concurrent or repeatable exposure, not annual flow volume. A multi-call exploit or ordinary composition through scoped contracts is still direct. The number of transactions or contracts in the path does not reduce demonstrated impact. Impact inheritance Where a Tier 2, 3, or 4 root gives the attacker Tier 1-equivalent reach, the Tier 1 ceiling applies. Examples: A shared wallet or beacon bug that reaches many deployed wallets. A fee-module bug that systematically drains makers through reusable approvals. An oracle-adapter bug reusable across many markets. A ramp or adapter bug repeatable against the backing reserve or global ledger. One root receives one reward. Use the highest applicable tier and aggregate affected funds once. Rewards do not stack by contract or tier. Web2 Severity │ Description │ Examples Critical │ Vulnerabilities that can lead to severe loss of user funds, permanent system disruption, or widespread compromise │ - Execute arbitrary system commands
- Retrieve sensitive data/files from a running server, such as: /etc/shadow , database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)
- Taking down the application/website
- Supply-chain compromise or web cache poisoning that reaches a wallet connecting origin (any page that loads the trading interface, connects to or holds a user wallet, or sends script to a page that does)
- Subdomain takeover when the subdomain is a wallet connecting origin (any page that loads the trading interface, connects to or holds a user wallet, or sends script to a page that does)
- Showing a user an attacker-controlled deposit address
- Direct theft of user funds
- Malicious interactions with an already-connected wallet, such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions
- Injection of malicious HTML or XSS through metadata High │ Vulnerabilities that cause notable financial loss or significantly harm user trust, but on a lesser scale than Critical. │ - Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information, Commenting
- Injecting/modifying the static content on the target application without JavaScript (persistent), such as: HTML injection without JavaScript, Replacing existing text with arbitrary text, Arbitrary file uploads, etc.
- Improperly disclosing confidential user information, such as: Email address
- Subdomain takeover when the subdomain is not a wallet connecting origin (any page that loads the trading interface, connects to or holds a user wallet, or sends script to a page that does) Medium │ Vulnerabilities that lead to limited financial damage or moderate system impact. │ - Injecting/modifying the static content on the target application without JavaScript (reflected), such as: Reflected HTML injection, Loading external site data Low │ Findings that pose minimal direct risk but reflect areas for improvement or best practices. │ - Changing details of other users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction, such as: Iframing leading to modifying the backend/browser state
- Taking over broken or expired outgoing links, such as: Social media handles, etc.
- Temporarily disabling user to access target site, such as: Locking up the victim from login, Cookie bombing, etc. Payout Remote code execution, server side secrets, stay Critical but pay the minimum. The full range opens only if the report shows funds were lost. Pay 10% of the funds a bug could take, within the band. In addition to the above definitions, we will also use the Cantina Bug Bounty Severity Classification Framework to determine severity. Likelihood Definitions High: Very easy to exploit or highly incentivized. Medium: Exploitation is possible under certain conditions. Low: Difficult to exploit or requires very specific conditions. Smart Contract Tier Rules The following rules apply exclusively to Smart Contract Tiers 1-4 and do not apply to Web & App findings. Proxy and beacon coverage Every scoped proxy entry automatically includes: The proxy and its state. The implementation active when the report is submitted. Any implementation activated after discovery but before remediation. Initializer, storage-layout, delegatecall, and upgrade-authorization flaws affecting the proxy. For beacon systems, the beacon, forwarder, active default implementation, authorized legacy implementations, and deployed beacon proxies. Legacy retirement Unless Polymarket has informed Cantina that it is retired, a legacy deployment stays in scope while any of the following is true: It holds funds or positions. Users retain effective approvals to it. Production services still call it. Unresolved markets or redemptions depend on it. Absent such notice, remove or lower it only after a signed retirement record confirms all four conditions are false or safely bounded. Any legacy deployment or asset, including any funds held therein, is considered strictly out of scope as soon as Polymarket informs Cantina of its retirement, regardless of whether it is technically paused. Future deployment activation Newly deployed contracts enter scope at the time they are deployed and activated through a scoped proxy, beacon, registry, or production integration. This includes new oracle aggregators, reporter modules, implementations, and modules. Addresses that exist only in configuration, or that are predicted but not yet deployed, are not in scope. The scope will be updated to list each new contract under the tier that matches its authority and blast radius. Until it is listed, the contract is covered under this rule at the tier appropriate to its function. Privileged paths Compromise of a legitimate privileged key stays out of scope. An unprivileged bug that bypasses authorization, escalates into a privileged path, or lets an attacker replace an implementation stays in scope. Prohibited Actions No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setups. No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose. No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service. No Front-Running or MEV Exploitation: Do not use knowledge gained from vulnerability research to front-run transactions, extract MEV, or gain trading advantage on Polymarket or related markets. No Conflict of Interest: Individuals currently or formerly employed by Polymarket, or those who contributed to the development of the affected code, are ineligible to participate. No Off-Platform Contact: All discussion about a submitted finding must happen on Cantina. Contacting the program client or its employees about it through any other channel may result in the finding being rejected with no reward and a ban from the Cantina platform. Disclosure Requirements You must report vulnerabilities directly to the Spearbit/Cantina platform. Please include: A clear description of the vulnerability and its impact. Steps to reproduce the issue, ideally with a proof of concept (always need a proof of concept for smart contracts) Details on the conditions under which the issue occurs. Potential implications if the vulnerability were exploited. Reports should be made as soon as possible—ideally within 24 hours of discovery. Proof of Concept Requirements Smart Contract Critical/High: MUST include a working Foundry test on a local Polygon fork demonstrating the exploit. The PoC should clearly show: (a) the initial state, (b) the exploit steps, (c) the resulting impact (e.g., stolen funds, frozen state). Smart Contract Medium/Low: Written technical explanation of the attack path required. Foundry PoC encouraged but not required. Web/App Critical/High: MUST include step-by-step reproduction with screenshots or video. Reports without adequate PoC will be triaged at lower priority and may be downgraded in severity. Eligibility To be eligible for a reward, you must: Be the first to report a previously unknown, non-public vulnerability within the defined scope. Provide sufficient information to reproduce and fix the vulnerability. Not have exploited the vulnerability in any malicious manner. Not have disclosed the vulnerability to third parties before receiving permission. Comply with all Program rules and applicable laws. You must also be of legal age in your jurisdiction and not be a resident in a country under sanctions or restrictions, as required by applicable laws. Other Terms By submitting a report, you grant Polymarket the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Polymarket. The terms, conditions, and scope of this Program may be revised at any time. All participants are responsible for reviewing the latest version before submitting a report.