Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
2 in-scope
api.dicey.comurl· criticaldicey.comurl· criticalfirst indexed
90d ago · 2 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for Magic Eden.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/magic-eden",
"name": "Magic Eden",
"handle": "magic-eden",
"targets": {
"in_scope": [
{
"asset_type": "URL",
"instruction": "Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.\nStrictly Out of Scope:\nNo Social Engineering.\nNo Non-Production Assets: Testing is limited to production only; ignore test/dev environments.\nNo DoS/DDoS: Do not attempt to disrupt our services.\nReports failing to follow these guidelines will be disqualified from rewards.",
"max_severity": "critical",
"asset_identifier": "api.dicey.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.\nStrictly Out of Scope:\nNo Social Engineering.\nNo Non-Production Assets: Testing is limited to production only; ignore test/dev environments.\nNo DoS/DDoS: Do not attempt to disrupt our services.\nReports failing to follow these guidelines will be disqualified from rewards.\n",
"max_severity": "critical",
"asset_identifier": "dicey.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "Cryptocurrency = Solana.\nOnly reports detailing High or Critical severity issues will be reviewed for potential rewards",
"max_severity": "none",
"asset_identifier": "*.magiceden.dev",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": false,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "OTHER",
"instruction": "Only reports detailing High or Critical severity issues will be reviewed for potential rewards",
"max_severity": "none",
"asset_identifier": "*.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": false,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*.magiceden.workers.dev",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": false,
"availability_requirement": "medium",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "This service is done through substack and they are unwilling to fix reported bugs",
"max_severity": "none",
"asset_identifier": "blog.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "cdn.magiceden.dev",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "docs.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "eng.magiceden.dev",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "eng.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "help.dicey.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "http://auth.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "http://ord-mirror.magiceden.dev",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "img-cdn.magiceden.dev",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "Program Focus:\nWe are only accepting High and Critical severity reports.\nReports must be specifically related to Solana protocols or NFT-integrated functionality",
"max_severity": "none",
"asset_identifier": "magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": false,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "mainframe.magiceden.io",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "staging.dicey.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "http://magiceden.io",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 139,
"response_efficiency_percentage": 66,
"average_time_to_report_resolved": 228,
"average_time_to_first_program_response": 6
}