Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
24 in-scope
*.crypto.comscope· critical*.mona.coscope· criticalexperiences.crypto.com· criticalcrypto.com/nft· criticalcrypto.com/price· mediumtickets.crypto.com· criticaltravel.crypto.com· criticalapp.mona.co· criticaldeveloper-api.crypto.com· criticaldeveloper-platform-api.crypto.com· criticaldeveloper.crypto.com· criticalcrypto.com/exchange· criticaljs.crypto.com· criticalmerchant.crypto.com· mediumnadex.com· mediumog.com· criticaltax.crypto.com· criticalweb.crypto.com· criticalCrypto.com Exchange APIs that require an account· criticalCrypto.com mobile app APIs that require an account· criticalcom.monaco.mobile· highetherscan.io/token/0xfe18…c38e· criticalexplorer.cronos.org/token/0x2e53…495d· criticalco.mona.android· high+ added 2 scopes · experiences.crypto.com, tickets.crypto.com
− removed 3 scopes · Crypto.com Wallet Extension, com.defi.wallet, com.defi.wallet
80d ago
first indexed
92d ago · 25 in-scope assets
No reports yet. Be the first to share your triage timing for Crypto.com.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/crypto",
"name": "Crypto.com",
"handle": "crypto",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact.",
"max_severity": "critical",
"asset_identifier": "*.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "WILDCARD",
"instruction": "We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact.",
"max_severity": "critical",
"asset_identifier": "*.mona.co",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "API",
"instruction": "Includes any BFF APIs",
"max_severity": "critical",
"asset_identifier": "Crypto.com Exchange APIs that require an account",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "API",
"instruction": "Includes any BFF APIs",
"max_severity": "critical",
"asset_identifier": "Crypto.com mobile app APIs that require an account",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "app.mona.co",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Get the app here: https://play.google.com/store/apps/details?id=co.mona.android\n\nYou won’t need test accounts for this as it will be public-facing sites for now.\n\nThe app should give you the functionality to start using CRO services.",
"max_severity": "high",
"asset_identifier": "co.mona.android",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": null,
"max_severity": "high",
"asset_identifier": "com.monaco.mobile",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "developer-api.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "developer-platform-api.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "developer.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "critical",
"asset_identifier": "experiences.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://crypto.com/exchange",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "critical",
"asset_identifier": "https://crypto.com/nft",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "medium",
"asset_identifier": "https://crypto.com/price",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "medium"
},
{
"asset_type": "SMART_CONTRACT",
"instruction": "**Bounty Range Changes: CDCETH Smart Contract**\n\nCritical Severity: Up to $50,000 USD\nExtreme Tier: Up to $1,000,000",
"max_severity": "critical",
"asset_identifier": "https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SMART_CONTRACT",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "js.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "Reward for GraphQL-based DOS that can cause service disruption will be capped at $200 USD",
"max_severity": "medium",
"asset_identifier": "merchant.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "medium",
"asset_identifier": "nadex.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "OG is available now in the U.S. via App Store, Google Play, and OG.com.",
"max_severity": "critical",
"asset_identifier": "og.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "critical",
"asset_identifier": "tax.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "critical",
"asset_identifier": "tickets.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "For this asset, we only accept Critical and High severity issues.",
"max_severity": "critical",
"asset_identifier": "travel.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "web.crypto.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "none",
"asset_identifier": "Crypto.com Wallet Extension",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": false,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "https://apps.apple.com/app/crypto-com-wallet/id1512048310",
"max_severity": "none",
"asset_identifier": "com.defi.wallet",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": false,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "https://play.google.com/store/apps/details?id=com.defi.wallet",
"max_severity": "none",
"asset_identifier": "com.defi.wallet",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": false,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "none",
"asset_identifier": "https://github.com/crypto-com/chain-desktop-wallet",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": false,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://github.com/crypto-com/cro-staking",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://github.com/crypto-com/swap-contracts-core",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://github.com/crypto-com/swap-contracts-periphery",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://crypto.com",
"offers_swag": true,
"managed_program": false,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 124,
"response_efficiency_percentage": 100,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": 14
}