AllBountiesDisclosedResolvedClosed

RecentMost Kudos

#0x6F

Jupiterruled a report not applicable

about 16 hrs ago

Information Disclosure

@lau90

#0x6E

Jupiternoted a report as informative

yesterday

Improper Access Control

@fcc

#0x6C

Jupiterruled a report not applicable

2 days ago

Business Logic Flaw

@easytrend

#0x69

Jupiterruled a report not applicable

5 days ago

Price Oracle Manipulation

@saturnbash

#0x4F

1

Jupiterawarded$300

6 days ago

Information Disclosure·1d

@fcc

#0x68

Jupiternoted a report as informative

1 week ago

Missing Authorization

@saturnbash

#0x67

Jupiterruled a report not applicable

1 week ago

Business Logic Flaw

@pjus

#0x66

Jupiternoted a report as informative

1 week ago

Denial of Service

@satyam

#0x65

Jupiterruled a report not applicable

1 week ago

Improper Access Control

@karm

#0x64

Jupiternoted a report as informative

1 week ago

Insufficient Session Expiration

@cybeida

#0x63

Jupiternoted a report as informative

1 week ago

Improper Access Control

@karm

#0x5E

Jupiternoted a report as informative

1 week ago

Incorrect Authorization

@cybeida

#0x5D

Jupiterruled a report not applicable

1 week ago

Cross-Site Request Forgery (CSRF)

@cybeida

#0x61

Jupiternoted a report as informative

1 week ago

Insufficient Session Expiration

@cybeida

#0x59

Meteoranoted a report as informative

1 week ago

Security Misconfiguration

@bruda

#0x5F

TOCTOU Attack Allows Wallet Drain via Transaction Simulation Spoofing

Jupiternoted a report as informative

1 week ago

Time-of-Check to Time-of-Use (TOCTOU)

@purge

#0x54

Jupiternoted a report as informative

2 weeks ago

JWT Algorithm Confusion

@cybeida

#0x5C

systemic Inadequate CPI Target Program and Owner/Signer Validation Across Multiple Jupiter Programs

Jupiterruled a report not applicable

2 weeks ago

Insecure Direct Object Reference (IDOR)

@bruda

#0x5A

flawed CSRF implementation

Jupiternoted a report as informative

2 weeks ago

Cross-Site Request Forgery (CSRF)

@cybeida

#0x55

Jupiternoted a report as informative

2 weeks ago

Security Misconfiguration

@bruda

#0x57

Public Swagger / OpenAPI documentation on 5 Jupiter production APIs reveals every internal route, including the 1000-JUP token-verify payment flow

Jupiternoted a report as informative

2 weeks ago

Security Misconfiguration

@bruda

#0x56

Subdomain takeover candidate at admin.verify.jup.ag — dangling Vercel CNAME (DEPLOYMENT_NOT_FOUND)

Jupiternoted a report as informative

2 weeks ago

Security Misconfiguration

@bruda

#0x52

Jupiternoted a report as informative

3 weeks ago

Information Disclosure

@cybeida

#0x51

Jupiternoted a report as informative

3 weeks ago

Information Disclosure

@cybeida

#0x53

Jupiterflagged a report as a duplicate

3 weeks ago

Session Fixation

@cybeida