Tor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tor daemon asset row) │ $4,000 │ $5,000 High │ $2,000 │ $2,500 Medium │ $500 │ $625 Low │ $100 │ $125 Submit a vulnerability CVE history 6 Last 12 months 41 Lifetime Denial of service 35 % Info disclosure 30 % Memory safety 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview Tor is the C daemon that actually speaks the onion-routing protocol, relay, client, directory authority and onion service all in one binary, serving millions of daily users across roughly eight thousand relays. Ubiquity is the wrong lens for it: the population is people for whom a deanonymisation bug is a physical-safety event, and the code is the reference implementation of the most widely deployed anonymity protocol in existence, embedded in Tails, Whonix, Brave's private windows and a long tail of privacy tooling. The Tor Project pays for it on HackerOne out of a pool funded by the Internet Bug Bounty, and the Tor asset row runs $100 for a low up to $4,000 for a critical, the higher of the program's two rows. sorona.xyz adds 1.25× on top of whatever the Tor Project awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~3 days First response not published Triage ~10 days Bounty In scope The program pays for supported versions of two products only, the Tor daemon and Tor Browser. This page is the Tor asset row: the onion-routing daemon at gitlab.torproject.org/tpo/core/tor, graded up to critical, in the releases the download page lists as current The daemon in every role the single binary takes: client, relay, bridge, directory authority and onion service. The same code ships for all of them, so a defect reachable in any one of them counts The link and circuit layer in full: TLS link handshakes, the ntor and ntor-v3 circuit handshakes, relay-cell cryptography, flow control and the padding machinery on top The directory subsystem end to end: descriptor and consensus document parsing, authority voting and signature checking, and the client side that fetches, validates and caches all of it Onion services v3 across the whole flow, from descriptor publication and encryption through introduction and rendezvous to the client lookup, plus the ed25519 identity and blinded-key handling behind it Guard selection, path selection and the rest of the code that decides which relays a circuit gets built from The local interfaces the daemon exposes: the SOCKS port, the control port and its authentication, the torrc parser and the command line Pluggable-transport management and the bridge and proxy paths the daemon drives when a direct connection to the network is blocked The internal library tree under src/lib : buffers, encoding and string handling, compression, the crypto wrappers over OpenSSL or NSS, and the event loop and networking core every subsystem sits on Out of scope Tor Browser, which the same program pays on its own asset row at up to $3,000 critical and which this row does not cover The Tor Project's hosted services, meaning the website, the bug tracker and the server infrastructure, all carried in the structured scope as not bounty-eligible Orbot, OONI and Tor Messenger, the other Tor Project products the scope list marks ineligible Versions of the daemon outside the supported set the download page lists as current Reports sent by email rather than through HackerOne, which the policy treats as forfeiting the bounty Model-generated findings submitted without manual verification and a working proof of concept, which are closed as informational Most-valued findings A deanonymisation or traffic-confirmation attack that identifies a client or locates an onion service. Info disclosure is 30% of the published record here and this is what a $4,000 critical looks like on this codebase Remotely reachable memory corruption in relay-cell handling or directory-document parsing, driven by a hostile peer rather than by a local configuration file. Memory safety is 20% of the record and the C implementation is why it stays there Relay or consensus resource exhaustion a single cheap client can trigger network-wide, the largest published class on this project at 35% Onion-service v3 crypto flaws in key blinding or descriptor encryption that let a third party impersonate a service or enumerate what has been published Consensus-validation defects that let a minority of directory authorities push clients onto different views of the network Bias in guard or path selection that an attacker can induce, since choosing the relays is itself a deanonymisation primitive Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reports must go through HackerOne; sending the finding by email forfeits the bounty AI-generated findings without manual verification and a working proof of concept are closed as informational Test supported versions of the daemon only, as listed on the download page the scope row points at Tor Browser and the Tor Project's hosted services are separate assets and are not covered by this row, so aim the report at the right one Rewards are funded by the Internet Bug Bounty, which paused its own intake on 27 March 2026 with no announced resumption; the Tor Project's program is still open and offering bounties, but confirm the reward pool before committing heavy effort Program stats 68 Reports resolved $20.5k Bounties paid 51% Response efficiency Disclosure Coordinated through The Tor Project on HackerOne. The policy's only relevant term is a safe-harbour promise rather than a confidentiality clause, so sorona.xyz can carry the report; the discipline that matters is timing, and sorona.xyz holds the details until a fixed release has shipped and relays have had a window to upgrade. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability