Bounties
Bounties
Bounties
Sign in
  1. All public bounties

Cantina Bounty

Review the program scope and policy before joining as a Cantina researcher.

LiveHosted by Cantina

Program overview

No details provided.

Asset scope and rewards

Review the in-scope and out-of-scope assets before researching.

Top reward
$5,000
In-scope assets
2
Groups
2

Web Interface / Application

2 assets

Cantina Website and Application

  • CriticalUp to $5,000
  • HighUp to $2,000
  • MediumAmount not specified
  • LowAmount not specified

  • https://cantina.xyz

    Reference: cantina.xyz

    Only Cantina website and its subdomains are eligible for rewards.

  • https://cantina.security

    Reference:

Policy and instructions

This program does not require identity verification.

Cantina is the one-stop shop for all your security needs, allowing you to source the best network of teams, freelancers, and services to keep your smart contracts secure.

Guidelines

  1. Scope: Only vulnerabilities found on our websites

    • and its subdomains are eligible for rewards.

Join this program

Join with your Cantina researcher account to participate in this program.

Sign in to join

Maximum reward

$5,000.00

Maximum reward by severity
SeverityMax. reward
Critical$5,000.00
High$2,000.00
cantina.security

Only Cantina website and its subdomains are eligible for rewards.

Out of Scope

Out of scope

1. Physical attacks against our employees, offices, or data centers 2. Social engineering attacks against our employees or users 3. Vulnerabilities in applications or systems not owned by us 4. Vulnerabilities requiring physical access to a user's device 5. Recently disclosed 0-day vulnerabilities (within 2 weeks of public disclosure)

Listed for reference. New findings can’t target these assets.

No assets listed in this group.

  • and its subdomains are eligible for rewards.
  • Any email infrastructure used by cantina.xyz or cantina.security

  • Testing: Do not perform any testing that could disrupt our services or compromise user data.

  • Disclosure: Do not disclose any vulnerabilities publicly before we've had a chance to address them.

  • Submission: All submissions must be done on this bounty repository on new cantina platform. More details on submissions

    • Severity Levels

    1. Critical

      • Remote code execution
      • Unauthorized access to sensitive user data
      • Ability to perform actions as a privileged user

    2. High

      • SQL injection
      • Cross-Site Scripting (XSS) with significant impact
      • Authentication bypass

    Please note that the final reward amount is at the discretion of our security team and depends on the potential impact and exploitability of the reported vulnerability.

    Out of Scope

    The following activities and vulnerability types are considered out of scope for this bug bounty program:

    1. Physical attacks against our employees, offices, or data centers
    2. Social engineering attacks against our employees or users
    3. Vulnerabilities in applications or systems not owned by us
    4. Vulnerabilities requiring physical access to a user's device
    5. Recently disclosed 0-day vulnerabilities (within 2 weeks of public disclosure)

    Testing Guidelines

    To ensure safe and responsible testing:

    1. Use only your own accounts or test accounts for testing.
    2. Do not attempt to access, modify, or destroy data that does not belong to you.
    3. Be mindful of testing that might impact system availability or integrity.
    4. Important: Please be extremely cautious when performing any automated scans or tests that involve multiple requests. Excessive traffic may be flagged as malicious activity.

    If you're unsure whether a specific test is allowed, please contact us before proceeding.

    Thank you for helping us keep our platform secure!