- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on AuditOne
- Submit through the program page.
- Payment
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What AuditOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 from $3,000 |
| High |
|
$3,000 from $1,000 |
| Medium |
|
$1,000 from $300 |
| Low |
|
$300 |
Scope
0 assets you may test, 3 excluded.
AuditOne does not list the scope of this program publicly. Check its policy.
Out of scope (3)
- mainnet or public testnet contracts
- pricing oracles or third party smart contracts
- third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Safura (via AuditOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
-
Attempting phishing or other social engineering attacks against our employees and/or customers
-
Any denial of service attacks
-
Automated testing of services that generates significant amounts of traffic
-
As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
-
Please do NOT publish/discuss bugs
Summarised with AI from the program policy on AuditOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 9 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from www.auditone.io on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
EN Subscribe to our new Newsletter for Certification Body Professionals & ISO Auditors → Here View all bounties Participate Safura Solidity Safura is a decentralized protection protocol designed to cover Web3 users and projects from risks like exploits, cyberattacks, and smart contract vulnerabilities. End date: December 31, 2026 KYC: Required NO Range of bounty $300 - $10,000 Severity Critical $3,000 - $10,000 High $1,000 - $3,000 Medium $300 - $1,000 Low up to $300 Scope: TBA Rules and Requirements: Any testing with mainnet or public testnet contracts; all testing should be done on private testnets Any testing with pricing oracles or third party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks) Any denial of service attacks Automated testing of services that generates significant amounts of traffic Public disclosure of an unpatched vulnerability in an embargoed bounty Disclosure Policy & Guidelines As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization No vulnerability disclosure, including partial, is allowed for the moment. Please do NOT publish/discuss bugs How it works Severity ranking Code of Conduct About the Company AuditOne envisions a digital world where high-quality security and absolute transparency are fundamental principles, not afterthoughts. At the heart of this mission is our TIC OS ("Testing, Inspection & Certification Operating System") for certification bodies. This specialized AI-native ERP system serves as the foundational infrastructure for the entire security lifecycle, automating complex workflows and ensuring institutional-grade reliability. Rather than viewing an audit as a static event, our AI-native operating system allows for a modular, comprehensive approach to project integrity. By integrating advanced technology with deep human expertise, AuditOne is setting the benchmark for how trust is built and maintained in the decentralized economy. Newsletter Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. For Projects Request Audit Submit a Bounty AI Systems Audit Penetration Test KYC TIC OS Price Calculator For Auditors Start Auditing Auditing Tools Academy For Community AI Lite Paper Blog Ambassador Program Newsletters Company About Us Partnerships Docs Brand guidelines Privacy & Cookies Trust Center Imprint ©2026 AuditOne GmbH. All rights reserved. X Request a service or product from AuditOne Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. Twitter Medium LinkedIn YouTube