- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
- Replies within 1 day
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
- Response
-
Within 1 days
First Response 1d
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 8 excluded.
Smart contracts 3
- https://etherscan.io/address/0x4ffb0e15dd08147cc64da9e73b24dc40b1a6c584
- https://etherscan.io/address/0xbc962d7be33d8afb4a547936d8ce6b9a1034e9ee
- https://etherscan.io/address/0xd67fd2dfe741b15bd93df796b66868347e887ba2
Out of scope (8)
- Best practice
- Code style guide violations
- Gas optimizations
- Old compiler version
- Redundant code
- The compiler version is not locked
- Theoretical vulnerabilities without any proof or demonstration
- Vulnerabilities in imported contracts
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Unistake Smart Contracts (via HackenProof)'s policy.
While testing
-
Perform testing only within the scope
-
Test only on private testnet, no testing for third party contracts
-
Only vulnerabilities that can lead to real issues are covered by the bug bounty program
-
Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
Not accepted
-
Theoretical vulnerabilities without any proof or demonstration
-
Old compiler version
-
The compiler version is not locked
-
Vulnerabilities in imported contracts
-
Code style guide violations
-
Redundant code
-
Gas optimizations
-
Best practice
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackenproof.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Bug bounty Unistake Smart Contracts: Program info Unistake Smart Contracts Company: Unistake Scope Review: 240894 Submissions: 5 Total rewards: $0 Program left: 5 years ago Finished Submit report Contest is not active Program info Hackers 2 Reports 0 Unistake is a decentralized token protocol built to empower DeFi projects and incentivize liquidity providers. All Scope Focus Area Program Rules Documentation Rewards Scope Search targets In scope Target │ Type │ Severity Multiplier Copy https://etherscan.io/address/0xbc962d7be33d8afb4a547936d8ce6b9a1034e9ee │ Solidity │ Critical PoolStake Copy https://etherscan.io/address/0x4ffb0e15dd08147cc64da9e73b24dc40b1a6c584 │ Solidity │ Critical PoolStakeFactory Copy https://etherscan.io/address/0xd67fd2dfe741b15bd93df796b66868347e887ba2 │ Solidity │ Critical Focus Area In Scope We are looking for evidence and reasons for incorrect behavior of the smart contract, which could cause unintended functionality: Stealing or loss of funds Unauthorized transaction Transaction manipulation Attacks on logic (behavior of the code is different from the business description) Reentrancy Reordering Over and underflows Out of Scope Theoretical vulnerabilities without any proof or demonstration Old compiler version The compiler version is not locked Vulnerabilities in imported contracts Code style guide violations Redundant code Gas optimizations Best practice Program Rules Perform testing only within the scope Test only on private testnet, no testing for third party contracts Only vulnerabilities that can lead to real issues are covered by the bug bounty program In special cases, the size of the award can be increased if the researchers demonstrate how the vulnerability can be used to inflict maximum harm Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission Documentation PoolStake Explainer Doc PoolStakeFactory Explainer Doc Multiplier Explainer Doc Previous Audit Rewards Critical 3,500 - 5,000 USDT High 1200 - 1500 USDT Medium 200 - 300 USDT Low 100 USDT Live since 26 Feb 2021 Last updated 19 Mar 2025 Range of bounty $100 - $5,000 Severity Critical $0 High $0 Medium $0 Low $0 blockchain smart contract fu @futurehacker 1 @TheWhiteEvil Verified 2 Response type Business days First Response 1d Triage Time 2d Reward Time 1d Resolution Time 2d