Help secure the Bouclier protocol. We offer rewards for responsibly disclosed vulnerabilities across all protocol components.
The bug bounty program is active for testnet contracts and SDK code. Report scope will expand to mainnet contracts upon deployment. All valid reports receive acknowledgment within 48 hours.
Fund loss, consensus bypass, or remote code execution on sentinel nodes.
Policy bypass, unauthorized agent actions, or state corruption vulnerabilities.
Denial of service, information leaks, or griefing attacks with limited impact.
Minor issues, gas optimizations, or informational findings with minimal risk.
Smart contract vulnerabilities — registry, policies, verification
SDK security issues — auth bypass, input validation, key handling
Sentinel node exploits — consensus attacks, DoS, memory safety
Logic flaws in reference policy implementations
XSS, CSRF, and wallet interaction vulnerabilities
Security-relevant documentation errors (informational only)
Vulnerabilities must be reported privately via the disclosure form before any public disclosure.
Only test against testnet deployments (Base Sepolia). Do not test against mainnet contracts.
Social engineering, phishing, and physical attacks are out of scope.
Duplicate reports receive no reward — first valid report wins.
Severity is determined by the Bouclier security team based on impact and likelihood.
Rewards are paid in USDC on Base within 30 days of fix confirmation.
Submit via the bug bounty form with full reproduction steps
Security team confirms receipt and begins triage
Impact classified and reward range communicated
Patch developed, tested, and deployed via governance process
USDC payment sent after fix confirmation
Security researchers acting in good faith under this program are protected. We will not initiate legal action against researchers who discover and report vulnerabilities following the rules outlined above. This includes accessing systems, sending transactions to testnet contracts, and analyzing code — as long as no user funds or data are put at risk.
Found something? Submit a report and help secure the protocol.