We are pleased to announce our Bug Bounty Program for our crypto exchange. We take the security of our platform very seriously, and we believe that the best way to ensure the safety of our users' assets is through a community effort. We invite all ethical hackers to participate in this program and help us identify and fix any vulnerabilities on our platform.

As a reward for your contribution, we offer bounties ranging from $100 to $10,000, depending on the severity of the vulnerability. 

Submission Form:

https://help.bitmake.com/hc/en-us/requests/new?ticket_form_id=7112131997711

Response Targets:

BitMake will make a best effort to meet the following response targets for your participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Testing scopes:

OUT-OF-SCOPE WEB VULNERABILITIES:

Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk. 

• Vulnerabilities in third-party applications
• Assets that do not belong to the company
• Best practices concerns
• Vulnerabilities affecting users of outdated browsers or platforms
• Social engineering, phishing, physical, or other fraud activities
• Publicly accessible login panels without proof of exploitation
• Reports that state that software is out of date/vulnerable without a proof of concept
• Reports that generated by scanners or any automated or active exploit tools
• Vulnerabilities involving active content such as web browser add-ons
• Most brute-forcing issues without clear impact
• Denial of service (DoS/DDoS)
• Theoretical issues
• Moderately Sensitive Information Disclosure
• Spam (sms, email, etc)
• Missing HTTP security headers
• Infrastructure vulnerabilities, including:
• Certificates/TLS/SSL-related issues;
• DNS issues (i.e. MX records, SPF records, DMARC records etc.);
• Server configuration issues (i.e., open ports, TLS, etc.)
• Open redirects
• Session fixation
• User account enumeration
• Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking
• Descriptive error messages (e.g. Stack Traces, application or server errors)
• Self-XSS that cannot be used to exploit other users
• Login & Logout CSRF
• Weak Captcha/Captcha Bypass
• Lack of Secure and HTTPOnly cookie flags
• Username/email enumeration via Login/Forgot Password Page error messages
• CSRF in forms that are available to anonymous users (e.g. the contact form)
• OPTIONS/TRACE HTTP method enabled
• Host header issues without proof-of-concept demonstrating the vulnerability
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Content Spoofing without embedded links/HTML
• Reflected File Download (RFD)
• Mixed HTTP Content
• HTTPS Mixed Content Scripts
• Manipulation with Password Reset Token
• MitM and local attacks

OUT OF SCOPE - MOBILE APP

• Attacks requiring physical access to a user's device
• Vulnerabilities that require root/jailbreak
• Vulnerabilities requiring extensive user interaction
• Exposure of non-sensitive data on the device
• Reports from static analysis of the binary without PoC that impacts business logic
• Lack of obfuscation/binary protection/root(jailbreak) detection
• Bypass certificate pinning on rooted devices
• Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries
• Sensitive data in URLs/request bodies when protected by TLS
• Path disclosure in the binary
• OAuth & app secret hard-coded/recoverable in IPA, APK
• Sensitive information retained as plaintext in the device’s memory
• Crashes due to malformed URL Schemes or Intents sent to exported Activity/Service/Broadcast Receiver (exploiting these for sensitive data leakage is commonly in scope)
• Any kind of sensitive data stored in-app private directory
• Runtime hacking exploits using tools like but not limited to Frida/ Appmon (exploits only possible in a jailbroken environment)
• Shared links leaked through the system clipboard
• Any URIs leaked because a malicious app has permission to view URIs opened.

Known Issues

Please note that the BitMake Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.