- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 6
- Public CVEs
- 5
- Last change
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
Scope
6 assets you may test, 8 excluded.
APIs 2
- api.bitcoin.shapeshift.com
- api.ethereum.shapeshift.com
Domains 2
- app.shapeshift.com
- shapeshift.com
Android apps 1
- https://play.google.com/store/apps/details?id=com.shapeshift.droid_shapeshift&hl=en_US&gl=US
iOS apps 1
- https://apps.apple.com/us/app/shapeshift-buy-trade-crypto/id996569075
Out of scope (8)
- auth.shapeshift.com
- beta.shapeshift.com
- coincap.io
- portal.shapeshift.io
- portis.io
- shapeshift-io.hellonext.co
- shapeshift.zendesk.com
- Physical (or emulated!) KeepKey devices
Changes
Tracked since 11 Nov 2026. Last checked 33 minutes ago.
-
Back
Open for reports again.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Reward terms
The reward table or payout terms were edited
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-27892 | Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the har | Low 3.8 | 2 May 2023 |
| CVE-2021-31616 | Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB. | High 8.8 | 6 May 2021 |
| CVE-2019-18672 | Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachab | High 7.5 | 6 Dec 2019 |
| CVE-2019-14355 | On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side chann | Low 2.4 | 10 Aug 2019 |
| CVE-2018-6875 | Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to text containing characters that the device's font lacks. | High 7.5 | 14 Mar 2018 |