Find a security bug
Earn $50 USDC for responsibly disclosing a genuine security vulnerability in our apps.
We take the security of Action Tokens and our community apps seriously. If you discover a genuine security vulnerability (e.g. authentication bypass, data exposure, injection, broken access control, or a flaw that puts user funds or data at risk), report it to us privately and you'll earn $50 USDC once we verify and confirm the issue. Please practice responsible disclosure: do not exploit the bug, access or modify other users' data, or publicly share it before we've had a chance to fix it.
Reward scales with severity
Our AI rates every report when you submit it and the team confirms the rating before paying.
Critical
Direct loss of funds or full access to private data or admin controls
50 USDC
High
Exposes sensitive user data or lets an attacker take over accounts or actions
35 USDC
Medium
A real weakness that needs specific conditions or user interaction to abuse
20 USDC
Low
Minor weakness with limited impact or hardening gaps
10 USDC
Informational
Best-practice suggestions with no practical exploit
0 USDC
Describe the vulnerability in detail: where it is, how to reproduce it step by step, and its impact. Include screenshots or a screen recording as proof. Submit the wallet address where you'd like to receive your $50 USDC. Do not exploit the issue or disclose it publicly until we've resolved it.
Manual USDC transfer to the wallet you submit, sent after our team reviews and confirms the vulnerability.
Submit your proof
4 of 5 claims leftProvide the details below. Your reward depends on severity, up to 50 USDC.