
TRM Labs Public Bug Bounty Engagement
Bounty Range
Up to $1,000
external program


Bounty Range
Up to $1,000
external program
Welcome to TRM Labs, Inc bug bounty program! We are a digital asset compliance & risk management platform. We enabled our customers to monitor, detect and investigate crypto fraud and financial crime through are platform and APIs. Our mission is build a safer financial system for billions of people. We blend blockchain data with advanced analytics to help financial institutions and governments fight fraud, money laundering, and financial crime.
We're looking for passionate and driven researchers who can help us keep our platform secure and join us on our mission.
Good luck, and happy hunting!
For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Status: In scope
Reward Tiers:
Chainabuse is our public facing application that allows any user to report malicious crypto activity. The application provides a self-registration using a Sign Up flow so researchers are encouraged to create test accounts in compliance with Bugcrowd policy and perform testing. There no multiple roles on the application.
Please note that while this asset is in-scope, it is lower priority compared to our B2B platform (hence the difference in reward tiers).
| Name / Location | Tags | Known issues |
|---|---|---|
| chainabuse-staging.com | PostgreSQL, GraphQL, ReactJS, +1 | |
| api.chainabuse-staging.com | GraphQL, NodeJS |
All targets in scope are in a Staging environment. Please be mindful when scanning the targets and avoid any kind of intrusive scans which might result in a DoS or account lockouts. Please do not perform any scans / testing / validation in the production environment as it is completely out of scope for the program. Our staging environment is exact copy of production and it will be ahead of production in term of feature releases.
Anything not explicitly specified as an "In-Scope" target MUST be considered out of scope. Please use our responsible disclosure program to report any problems with targets outside the scope.
To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see Bugcrowd documentation.
This engagement follows Bugcrowd's standard disclosure terms. Vulnerabilities found in this engagement requires explicit permission by selecting the disclosure request option on your submission. For more information please review the Public Disclosure Policy.