0x
0x Protocol is the trusted, open standard that enables the secure settlement of digital assets trades on blockchain rails. Join the community that governs it.
Bounty Range
$1,000 - $1,000,000
external program
0x
0x Protocol is the trusted, open standard that enables the secure settlement of digital assets trades on blockchain rails. Join the community that governs it.
Bounty Range
$1,000 - $1,000,000
external program
The bug bounties on this page apply only to the 0x smart contracts on Ethereum mainnet, Binance Smart Chain, Polygon, Avalanche, Fantom, Celo, Optimism and future deployments in other EVM-compatible networks announced through our official communication channels.
Bug reports pertaining to 0x API and 0x web interfaces (e.g. Matcha, 0x.org), both in terms of UI/UX or servers/infrastructure, are not eligible. Only the first reporter of a given contract vulnerability will be rewarded, and findings already discovered as part of a formal audit are ineligible.
0x has completed smart contract audits with Consensys Diligence, Trail of Bits and ABDK. We run a continuous bug bounty program for the V4 release of the 0x core contracts.
The following contracts are in scope of the bug bounty. Please note that any bugs already reported are considered out of scope.
Release
| Contracts | Commit Hash |
|---|---|
| Exchange V4 | - Documentation at https://docs.0xProtocol.org/en/latest/ - ZeroEx.sol - ZeroExOptimized.sol - external/.sol - features/.sol - fixins/.sol - migrations/.sol - storage/*.sol |
| Exchange V3 | - ERC20BridgeProxy.sol - Exchange.sol - ZeroExGovernor.sol - Staking.sol - StakingProxy.sol - ZrxVault.sol |
| Exchange V2.1 | - src/2.0.0/protocol - src/2.0.0/utils |
| MultiAssetProxy | - MultiAssetProxy.sol |
| ERC1155Proxy | - ERC1155Proxy.sol |
| StaticCallProxy | - StaticCallProxy.sol |
| ERC20BridgeProxy | - ERC20BridgeProxy.sol |
The bounty program will pay out rewards according to the severity of a vulnerability. The severity of reported vulnerabilities will be graded according to the CVSS (Common Vulnerability Scoring Standard).
The final reward amount is at the sole discretion of 0x Labs and will be paid in the specified sum in either USD or ETH.
| Exploit Score | Reward |
|---|---|
| Critical (CVSS 9.0 - 10.0) | up to $1,000,000 |
| High (CVSS 7.0 - 8.9) | up to $350,000 |
| Medium (CVSS 4.0 - 6.9) | up to $35,000 |
| Low (CVSS 0.0 - 3.9) | up to $5,000 |
Please e-mail all submissions to [email protected] with the subject "BUG BOUNTY". Your submission should include any steps required to reproduce or exploit the vulnerability. Please allow time for the vulnerability to be fixed before discussing any findings publicly. After receiving a submission, we will contact you with expected timelines for a fix to be implemented.