- Top reward
- $100,000
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100,000
- for critical bugs, from $500.
- Report by email
- [email protected]
- Replies within 2 days
- As the policy promises.
- Paid by cryptocurrency
- Proof of identity needed to get paid.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$100,000 from $20,000 |
| High |
|
$30,000 from $7,500 |
| Medium |
|
$10,000 from $2,000 |
| Low |
|
$2,000 from $500 |
- Top reward
-
$100,000
Cap: $100,000.
- Lowest reward
-
$500
Floor: $500.
- Response
-
Within 2 days
We aim to acknowledge reports within 2 business days.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 4 excluded.
Domains 1
- relay.link
Out of scope (4)
- Relay Vaults
- the vaults API
- The Vaults contracts (RelayPool, RelayBridge, RelayPoolFactory, RelayBridgeFactory, RelayPoolNativeGateway)
- the vaults user interface
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Relay's policy. "We" in these lines means the program, not this site.
While testing
-
Send one email for each vulnerability.
-
Do not combine several findings in one report.
-
Use a clear subject line that names the affected component and the issue.
-
Put all relevant information in the first email.
-
Wait until the 7-day review window ends before asking for a status update.
-
Do not send a second report or open a new ticket for the same finding.
-
A different vulnerability needs a new email.
Not accepted
-
Attacks the reporter has already exploited.
-
Issues requiring phishing, social engineering, or a compromised private key.
-
Findings in third-party protocols we compose with, unless the root cause is in Relay’s code.
-
DoS with no fund loss and no path to fund loss.
-
Theoretical issues with no viable PoC against in-scope assets.
-
Relay Vaults.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.