kinetiq-contracts
Bounty Range
$1,000,000 - $1,000,000
external program
Bounty Range
$1,000,000 - $1,000,000
external program
Kinetiq is a liquid staking protocol built natively on Hyperliquid, enabling users to stake the native token of the Hyperliquid blockchain (HYPE) and receive Kinetiq Staked HYPE (kHYPE) in return.
kHYPE enables staking participation while retaining full liquidity and capital efficiency — earning staking rewards while staying active across DeFi.
Behind the scenes, all staked HYPE is automatically delegated to the top-performing Hyperliquid validators, selected by StakeHub—Kinetiq's autonomous validator scoring and delegation system.
Please carefully review prior audits at https://audits.kinetiq.xyz prior to submitting your findings. DO NOT submit duplicate findings.
Contracts in-scope:
If you discover a vulnerability in any component that is not explicitly listed but poses a risk to user funds, user data, or the integrity of the system, you may submit it for consideration. The team will review such submissions on a case-by-case basis.
No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setups.
No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.
No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service.
No Conflict of Interest: Individuals currently or formerly employed by Kinetiq, or those who contributed to the development of the affected code, are ineligible to participate.
Please report vulnerabilities directly through the Spearbit/Cantina platform. Please include:
Reports should be made as soon as possible—ideally within 24 hours of discovery.
To be eligible for a reward, you must:
You must also be of legal age in your jurisdiction and not be a resident in a country under sanctions or restrictions, as required by applicable laws.
Note: Kinetiq requires KYC prior to paying out a reward.
Vulnerabilities are classified using two factors: Impact and Likelihood. The combination of these factors determines the severity and guides the reward amount.
Risk Classification Matrix
| Severity Level | Impact: Critical | Impact: High | Impact: Medium | Impact: Low |
|---|---|---|---|---|
| Likelihood: High | Critical | High | Medium | Low |
| Likelihood: Medium | High | High | Medium | Low |
| Likelihood: Low | Medium | Medium | Low | Informational |
Critical:
High:
Medium:
Low:
| Severity | Maximum Payout |
|---|---|
| Critical | $5,000,000 |
| High | $50,000 |
| Medium | $5,000 |
| Low | $500 |
Note: Actual reward amounts are determined at Kinetiq's sole discretion. Factors influencing payout include quality of report, completeness, and the severity and exploitability of the vulnerability.
Please refer to the docs for default out of scope guidelines at https://docs.cantina.xyz/cantina-docs/cantina-bounties/bounty-severity-classification#out-of-scope
By submitting a report, you grant Kinetiq the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Kinetiq. The terms, conditions, and scope of this Program may be revised at any time. All participants are responsible for reviewing the latest version before submitting a report.