Program Overview

General Conditions

Submission of a report constitutes acceptance of this Policy and the scope published for this bug bounty.
Each Security Researcher is solely responsible for ensuring that participation, testing, submission, and receipt of any reward comply with all applicable laws and do not violate any third-party rights or obligations.
Each Security Researcher is solely responsible for all costs, fees, expenses, taxes, duties, and similar charges arising from participation or receipt of a reward. Meteora or the applicable payment processor may withhold or deduct any amount required by applicable law.
Any violation of this Policy or the scope published for this bug bounty may result in rejection of the report, loss of reward eligibility, or removal from this bug bounty. Meteora reserves all rights and remedies available under applicable law for any unauthorized, unlawful, harmful, or bad-faith conduct.

Reporting Requirements

Reports must identify the affected Program and include the attack prerequisites, a clear attack scenario, reproducible steps, and the resulting security impact.
A working PoC demonstrating concrete impact on a local fork of Solana mainnet is required. Any cloned or modified Programs, accounts, or state used in the PoC must be clearly identified. Theoretical reports and unvalidated scanner output are not eligible.
For any claimed economic or asset-loss impact, the report must substantiate the claim using reproducible assumptions and verifiable on-chain data and include at least: (i) the assets directly at risk and the state snapshot and valuation source used to calculate that amount; (ii) the attacker's required capital; (iii) nonrecoverable execution costs, including transaction or bundle fees, rent, protocol fees, slippage, and unwind costs; (iv) required liquidity, oracle and market conditions, transaction ordering, timing, and third-party actions; and (v) repeatability and any existing mitigations. Returned principal is not an attack cost. Unsupported maximum-impact assumptions are not accepted.
A report must include an actionable code-level or operational remediation or mitigation recommendation sufficient for Meteora to evaluate. If the recommendation is absent or incomplete, Meteora may close the report, deny reward eligibility, or reduce the reward amount.
A Security Researcher represents and warrants that the report, PoC, and all submitted materials are original or lawfully authorized for submission and do not violate any third-party intellectual property, confidentiality, contractual, or other rights.
A Security Researcher must provide accurate, complete, and non-misleading information and respond to any request for additional information within the stated deadline, which will ordinarily allow at least five business days for a response. Failure to do so may result in closure of the report or loss of reward eligibility. Meteora may grant extensions at its discretion.
A Security Researcher must submit one vulnerability per report unless multiple vulnerabilities must be chained to demonstrate impact.

Report Evaluation and Rewards

Acknowledgment, triage, requests for information, preliminary severity assessments, and remediation discussions do not constitute acceptance of a report, confirmation of eligibility, or a promise of payment.
A report may be classified as Intended Design and deemed ineligible for a reward if Meteora determines that the reported behavior is consistent with the Program's intended operation, a known limitation, or an accepted design trade-off.
Meteora may classify any report or pattern of submissions as Spam if it lacks meaningful technical substance, including, without limitation, vague or speculative claims without reproducible evidence or concrete security impact, unvalidated output from automated tools, and incoherent, technically irrelevant, or materially inaccurate descriptions of code or Program behavior.
Two or more such reports from the same Security Researcher may be treated as repeated Spam. Spam reports may be closed without further review and are not eligible for a reward. Repeated Spam may result in loss of eligibility for future reports or removal from this bug bounty.
Duplicate reports are not eligible for a bounty. When multiple reports cover the same underlying issue, only the first valid and reproducible report is eligible.
A report may also be classified as Duplicate if the issue was already known to Meteora before submission, including but not limited to knowledge from internal review, audits, monitoring, engineering work, or prior reports.
An issue may be considered previously known even if it has not been publicly disclosed or remediated at the time of submission. Final eligibility decisions are made case by case based on the information and records available to Meteora during review.
Multiple vulnerabilities, findings, or consequences arising from the same root cause are treated as one vulnerability and are eligible for no more than one reward.
A chain of vulnerabilities used together to produce one impact is eligible for a single reward. The reward is based on the highest-severity eligible vulnerability in the chain, not the cumulative impact of all steps.
Meteora retains sole discretion to determine a report's validity, scope, duplicate status, severity, eligibility, and reward amount.

Testing and Prohibited Conduct

A Security Researcher must perform all testing on a privately controlled local fork of Solana mainnet. Read-only RPC calls may be used only to retrieve publicly available data required for local reproduction. A Security Researcher must not submit transactions or other state-changing requests to mainnet, devnet, testnet, or any other public environment.
A Security Researcher must not disrupt production systems, Programs, services, or infrastructure, or access or affect any live account, asset, or non-public data belonging to another party.
If a Security Researcher inadvertently accesses or affects any live account, asset, or non-public data, the Security Researcher must stop immediately, take no further action, and notify Meteora through the OOOSEC platform.
After any such access, a Security Researcher must not use, retain, copy, transfer, or disclose any information or assets obtained through the access.
Stopping or providing notice does not authorize or excuse the conduct, create or restore reward eligibility, or limit any rights or remedies available to Meteora.
Volumetric or disruptive DoS or DDoS testing against any shared, production, or public environment is prohibited. Otherwise permitted testing of availability, compute exhaustion, account locking, or similar impact must be conducted only on a local fork of Solana mainnet and limited to what is reasonably necessary to demonstrate impact.
A Security Researcher must not conduct social engineering, phishing, unsolicited bulk messaging, or other disruptive or deceptive testing.
A Security Researcher must not exploit a vulnerability in a live environment to profit, transfer or withhold assets, extort any party, or cause harm.
A report and all related communications must be unconditional and must not include threats, ransom demands, coercive tactics, or demands for payment outside this bug bounty.
A Security Researcher must comply with applicable law and remain within the scope published for this bug bounty.

Eligibility

Eligibility is limited to vulnerabilities in the in-scope Program code that are not excluded by the scope published for this bug bounty or this Policy.
A vulnerability is eligible only if it is non-public, previously unreported, and not known to Meteora at the time of submission.
Current Meteora employees, contractors, auditors, contributors, and former personnel who worked on or had material confidential access to the affected Program during the preceding 24 months, are not eligible.
A report is not eligible if submitted directly or indirectly by, on behalf of, or in coordination with any person or entity that is ineligible under this Policy. Any attempt to circumvent an eligibility restriction through another person, entity, or account results in loss of reward eligibility.
Immediate family members and household members of any person who is ineligible under this Policy are also not eligible for a reward.
A Security Researcher must satisfy applicable sanctions and payment-verification requirements and provide any requested documentation. Payment restrictions do not change the technical validity or severity of a report but may affect reward eligibility or payment.

Confidentiality and Disclosure

A Security Researcher must submit reports and all related vulnerability information through the OOOSEC platform and may share such information only with Meteora and OOOSEC unless disclosure is authorized under this section.
A Security Researcher must not disclose to any other party or publish the existence, contents, status, severity, reward, communications, or any other information relating to a report, including in a public repository, without Meteora's prior written permission and any separate approval required by OOOSEC.
Remediation, report closure, or payment of a reward does not constitute permission to disclose.
Disagreement with any report evaluation, severity, eligibility, or reward decision does not authorize disclosure. Any unauthorized disclosure may result in immediate closure of the report, loss of reward eligibility, removal from this bug bounty, or any other action available to Meteora under applicable law.

General Conditions

Submission of a report constitutes acceptance of this Policy and the scope published for this bug bounty.

Each Security Researcher is solely responsible for ensuring that participation, testing, submission, and receipt of any reward comply with all applicable laws and do not violate any third-party rights or obligations.

Each Security Researcher is solely responsible for all costs, fees, expenses, taxes, duties, and similar charges arising from participation or receipt of a reward. Meteora or the applicable payment processor may withhold or deduct any amount required by applicable law.

Any violation of this Policy or the scope published for this bug bounty may result in rejection of the report, loss of reward eligibility, or removal from this bug bounty. Meteora reserves all rights and remedies available under applicable law for any unauthorized, unlawful, harmful, or bad-faith conduct.

Reporting Requirements

Reports must identify the affected Program and include the attack prerequisites, a clear attack scenario, reproducible steps, and the resulting security impact.

A working PoC demonstrating concrete impact on a local fork of Solana mainnet is required. Any cloned or modified Programs, accounts, or state used in the PoC must be clearly identified. Theoretical reports and unvalidated scanner output are not eligible.

For any claimed economic or asset-loss impact, the report must substantiate the claim using reproducible assumptions and verifiable on-chain data and include at least: (i) the assets directly at risk and the state snapshot and valuation source used to calculate that amount; (ii) the attacker's required capital; (iii) nonrecoverable execution costs, including transaction or bundle fees, rent, protocol fees, slippage, and unwind costs; (iv) required liquidity, oracle and market conditions, transaction ordering, timing, and third-party actions; and (v) repeatability and any existing mitigations. Returned principal is not an attack cost. Unsupported maximum-impact assumptions are not accepted.

A report must include an actionable code-level or operational remediation or mitigation recommendation sufficient for Meteora to evaluate. If the recommendation is absent or incomplete, Meteora may close the report, deny reward eligibility, or reduce the reward amount.

A Security Researcher represents and warrants that the report, PoC, and all submitted materials are original or lawfully authorized for submission and do not violate any third-party intellectual property, confidentiality, contractual, or other rights.

A Security Researcher must provide accurate, complete, and non-misleading information and respond to any request for additional information within the stated deadline, which will ordinarily allow at least five business days for a response. Failure to do so may result in closure of the report or loss of reward eligibility. Meteora may grant extensions at its discretion.

A Security Researcher must submit one vulnerability per report unless multiple vulnerabilities must be chained to demonstrate impact.

Report Evaluation and Rewards

Acknowledgment, triage, requests for information, preliminary severity assessments, and remediation discussions do not constitute acceptance of a report, confirmation of eligibility, or a promise of payment.

A report may be classified as Intended Design and deemed ineligible for a reward if Meteora determines that the reported behavior is consistent with the Program's intended operation, a known limitation, or an accepted design trade-off.

Meteora may classify any report or pattern of submissions as Spam if it lacks meaningful technical substance, including, without limitation, vague or speculative claims without reproducible evidence or concrete security impact, unvalidated output from automated tools, and incoherent, technically irrelevant, or materially inaccurate descriptions of code or Program behavior.

Two or more such reports from the same Security Researcher may be treated as repeated Spam. Spam reports may be closed without further review and are not eligible for a reward. Repeated Spam may result in loss of eligibility for future reports or removal from this bug bounty.

Duplicate reports are not eligible for a bounty. When multiple reports cover the same underlying issue, only the first valid and reproducible report is eligible.

A report may also be classified as Duplicate if the issue was already known to Meteora before submission, including but not limited to knowledge from internal review, audits, monitoring, engineering work, or prior reports.

An issue may be considered previously known even if it has not been publicly disclosed or remediated at the time of submission. Final eligibility decisions are made case by case based on the information and records available to Meteora during review.

Multiple vulnerabilities, findings, or consequences arising from the same root cause are treated as one vulnerability and are eligible for no more than one reward.

A chain of vulnerabilities used together to produce one impact is eligible for a single reward. The reward is based on the highest-severity eligible vulnerability in the chain, not the cumulative impact of all steps.

Meteora retains sole discretion to determine a report's validity, scope, duplicate status, severity, eligibility, and reward amount.

Testing and Prohibited Conduct

A Security Researcher must perform all testing on a privately controlled local fork of Solana mainnet. Read-only RPC calls may be used only to retrieve publicly available data required for local reproduction. A Security Researcher must not submit transactions or other state-changing requests to mainnet, devnet, testnet, or any other public environment.

A Security Researcher must not disrupt production systems, Programs, services, or infrastructure, or access or affect any live account, asset, or non-public data belonging to another party.

If a Security Researcher inadvertently accesses or affects any live account, asset, or non-public data, the Security Researcher must stop immediately, take no further action, and notify Meteora through the OOOSEC platform.

After any such access, a Security Researcher must not use, retain, copy, transfer, or disclose any information or assets obtained through the access.

Stopping or providing notice does not authorize or excuse the conduct, create or restore reward eligibility, or limit any rights or remedies available to Meteora.

Volumetric or disruptive DoS or DDoS testing against any shared, production, or public environment is prohibited. Otherwise permitted testing of availability, compute exhaustion, account locking, or similar impact must be conducted only on a local fork of Solana mainnet and limited to what is reasonably necessary to demonstrate impact.

A Security Researcher must not conduct social engineering, phishing, unsolicited bulk messaging, or other disruptive or deceptive testing.

A Security Researcher must not exploit a vulnerability in a live environment to profit, transfer or withhold assets, extort any party, or cause harm.

A report and all related communications must be unconditional and must not include threats, ransom demands, coercive tactics, or demands for payment outside this bug bounty.

A Security Researcher must comply with applicable law and remain within the scope published for this bug bounty.

Eligibility

Eligibility is limited to vulnerabilities in the in-scope Program code that are not excluded by the scope published for this bug bounty or this Policy.

A vulnerability is eligible only if it is non-public, previously unreported, and not known to Meteora at the time of submission.

Current Meteora employees, contractors, auditors, contributors, and former personnel who worked on or had material confidential access to the affected Program during the preceding 24 months, are not eligible.

A report is not eligible if submitted directly or indirectly by, on behalf of, or in coordination with any person or entity that is ineligible under this Policy. Any attempt to circumvent an eligibility restriction through another person, entity, or account results in loss of reward eligibility.

Immediate family members and household members of any person who is ineligible under this Policy are also not eligible for a reward.

A Security Researcher must satisfy applicable sanctions and payment-verification requirements and provide any requested documentation. Payment restrictions do not change the technical validity or severity of a report but may affect reward eligibility or payment.

Confidentiality and Disclosure

A Security Researcher must submit reports and all related vulnerability information through the OOOSEC platform and may share such information only with Meteora and OOOSEC unless disclosure is authorized under this section.

A Security Researcher must not disclose to any other party or publish the existence, contents, status, severity, reward, communications, or any other information relating to a report, including in a public repository, without Meteora's prior written permission and any separate approval required by OOOSEC.

Remediation, report closure, or payment of a reward does not constitute permission to disclose.

Disagreement with any report evaluation, severity, eligibility, or reward decision does not authorize disclosure. Any unauthorized disclosure may result in immediate closure of the report, loss of reward eligibility, removal from this bug bounty, or any other action available to Meteora under applicable law.