EXMON - Bug Bounty Program

Bug Bounty Program

Last Update: 28 October 2026

The EXMON Bug Bounty Program rewards security researchers for responsibly disclosing vulnerabilities that pose a demonstrable threat to user assets, critical system infrastructure, or core user security.

All rewards are paid in USDT.

Reward Tiers

Rewards are determined by severity, exploitability, demonstrated impact, and report quality. A vulnerability must be reproducible and have a meaningful security impact to qualify for a reward. Low-impact, cosmetic, and purely informational findings are not eligible.

Extreme (P0) - 10,000 USDT
Critical (P1) - 3,000 - 5,000 USDT
High (P2) - 1,000 - 2,000 USDT
Medium (P3) - 200 - 400 USDT

The researcher's proposed severity rating is not binding. EXMON determines the final classification and reward based on the evidence provided and the criteria in this policy.

In-Scope Vulnerabilities

We consider vulnerabilities that demonstrably compromise or materially threaten user funds, internal ledger integrity, critical infrastructure, or core user security.

1. Financial and Wallet Security

Business logic flaws in payment, withdrawal, deposit, voucher, or referral modules that enable unauthorized credits, balance inflation, double withdrawals, or unauthorized fund manipulation.
Unauthorized access to or compromise of EXMON wallets, private keys, escrow mechanisms, or cryptocurrency payment infrastructure.
Vulnerabilities in cryptocurrency address rotation, payment confirmation, or fund distribution that bypass required security controls.

2. System Integrity and Infrastructure

Remote Code Execution (RCE) or command injection resulting in significant compromise of production infrastructure.
SQL injection, SSRF, IDOR, or similar vulnerabilities that enable unauthorized access to sensitive data, user accounts, or critical systems, with demonstrable security impact.
Unauthorized access to internal administrative interfaces, privileged service credentials, or production databases.
Vulnerabilities that compromise the integrity of critical system components or security controls.

3. User and Session Security

Authentication or authorization flaws resulting in unauthorized account takeover or significant compromise of user sessions.
Exposure of authentication tokens, API keys, or other credentials that enables unauthorized control of user accounts or platform systems.
Access-control vulnerabilities that permit unauthorized actions with a demonstrable impact on user security or system integrity.

Note: A missing security control, theoretical attack path, or technically possible data modification does not automatically qualify for a reward. The report must demonstrate a meaningful security consequence within the scope of this program.

Out-of-Scope Vulnerabilities

Reports that do not meet the program's eligibility criteria may be closed as Informative or Invalid without financial compensation.

The following findings are generally out of scope unless a demonstrable, material security impact establishes otherwise:

Missing security headers, cookie flags, non-sensitive path disclosures, software version disclosure, directory listings, and verbose error messages.
Theoretical vulnerabilities without a working, reproducible proof of concept (PoC).
Social engineering, phishing, physical attacks, or scams targeting EXMON users or staff.
DoS/DDoS, resource exhaustion, rate-limit testing, or stress testing that disrupts service availability.
Vulnerabilities in third-party libraries, dependencies, or services without a demonstrated exploit path affecting EXMON assets or systems.
Self-XSS, reflected XSS without meaningful impact, and CSRF affecting non-critical actions.
Automated scanner output, static analysis findings, or generic security recommendations without validated exploitation and impact.
Issues affecting outdated browsers or operating systems that cannot be reproduced in supported environments.
Known, duplicate, or previously reported vulnerabilities.
Findings based solely on intended behavior, documented limitations, or theoretical security concerns.

Strictly Forbidden Actions

The following actions are strictly prohibited and will result in immediate disqualification from the program and, where appropriate, referral to law enforcement:

Attempting to steal, transfer, freeze, or manipulate real user or platform funds. Proof-of-concept testing must be non-destructive and must not cause actual financial transactions or loss.
Accessing, copying, modifying, or deleting another user's data or system data without authorization. Testing must be confined strictly to your own accounts or authorized test accounts.
Conducting destructive tests that alter or corrupt production database records, wallet state, or security logs.
Publishing or disclosing confidential vulnerability details before coordinated disclosure has been agreed.
Using vulnerabilities for extortion, threats, ransom demands, or other coercive purposes.
Disrupting normal business operations through denial-of-service attacks, resource exhaustion, spam, or similar activity.
Conducting penetration testing outside the defined scope or without required authorization.
Using brute-force tools or high-concurrency scanners that degrade service performance.
Tampering with third-party accounts or attempting to bypass authentication protections on accounts that you do not own or have permission to test.
Attempting unauthorized physical access, social engineering, or intrusion into internal infrastructure.

Violations immediately void reward eligibility and may result in legal action under applicable computer security laws.

Severity Definitions and Evaluation

P0 / Extreme - 10,000 USDT

Catastrophic compromise of EXMON's critical assets or infrastructure, including:

Compromise of wallet infrastructure or private keys enabling unauthorized extraction of funds.
Unauthorized access to or extraction of platform or user funds with catastrophic financial or operational impact.

P1 / Critical - 3,000 - 5,000 USDT

Severe compromise of critical security controls or production systems, including:

Full takeover of administrative controls.
Remote Code Execution (RCE) on critical production servers resulting in extensive system compromise.
Widespread account takeover or capabilities enabling substantial unauthorized fund movement.

P2 / High - 1,000 - 2,000 USDT

High-impact vulnerabilities affecting sensitive assets, critical data, or important security boundaries, including:

SQL injection with substantial access to sensitive production data or critical systems.
IDOR or authorization flaws enabling targeted unauthorized access to accounts or funds.
Exposure of privileged credentials that creates a demonstrable threat to production assets.

P3 / Medium - 200 - 400 USDT

Vulnerabilities with a demonstrable, material impact on core user security, system integrity, or critical business logic, limited in scope and insufficient to qualify for a higher severity tier.

Findings that demonstrate only minor, self-limited, cosmetic, or informational impact are not eligible for a reward.

Severity is assessed according to the demonstrated impact, exploitability, attack prerequisites, affected assets, and scope. The technical vulnerability type alone does not determine severity.

Responsible Disclosure Rules

Limit exploitation strictly to what is necessary to confirm the vulnerability's existence.
Do not modify, delete, or exfiltrate other users' sensitive data.
Use only accounts you own or dedicated test accounts authorized by EXMON.
Do not perform real financial transactions or destructive actions during testing.
Keep vulnerability details confidential until coordinated disclosure has been agreed.
For critical vulnerabilities posing an immediate threat to funds or infrastructure, contact [email protected] immediately with the subject line: “Critical vulnerability - immediate contact”.

How to Submit a Report

Email your report to [email protected] with the subject line “Bug Bounty Report”.

Include the following information:

Executive summary of the vulnerability.
Affected module or component (API, payment logic, wallet engine, authentication, etc.).
Step-by-step reproduction instructions and a working PoC (requests, code, screenshots, or logs).
Demonstrated impact on funds, critical systems, sensitive data, or user security.
Attack prerequisites and any limitations of the exploit.
Researcher contact details.

Payouts and Terms

Eligible vulnerabilities are rewarded in USDT after validation by EXMON's security team.
Confirmation that a vulnerability exists does not automatically guarantee a reward. Verification confirms the presence of an issue but does not, by itself, guarantee eligibility under this program.
EXMON evaluates each report based on reproducibility, exploitability, affected assets, attack prerequisites, scope, and demonstrated security impact.
Reports may be classified as Informative or Invalid, assigned a lower severity, or declined for a reward when the demonstrated impact does not meet the published eligibility criteria.
EXMON will communicate the reason for a reward denial or a material severity adjustment to the researcher.
Duplicate reports or multiple findings arising from the same underlying root cause may be consolidated into a single reward allocation.
EXMON retains final authority over severity classification and reward amounts under this policy.
Researchers must comply with the program's scope, testing restrictions, and responsible disclosure requirements.

Final Terms

By submitting a report, researchers agree to comply with this policy and refrain from unauthorized exploitation, access to data, or disruption of EXMON services.

EXMON may update this program to clarify eligibility, scope, or evaluation criteria. Updated terms apply strictly to reports submitted after the revised policy is published.

EXMON appreciates responsible security research that helps protect user assets, platform infrastructure, and the overall security of its ecosystem.