Getting Started
To participate in bug bounty programs you must:- Create a Security Researcher Account
- Complete KYC and Payments before expecting a payout
- Browse active programs on Opportunities or from the program page in Cantina
Bounty Flow: From Submission to Payout
- Submit finding — researcher submits through Cantina Code.
- Triage — finding moves through statuses such as New and In Review (see Finding Statuses).
- Client review — client and triage confirm, reject, or mark duplicate.
- Confirmed — only Confirmed findings are eligible for payout.
- Payment — queued on the weekly cycle; see Bug Bounty Payout and Payout Schedule.
Testing Guidelines
To ensure responsible testing:- Use local forks instead of public chains.
- Avoid actions that may disrupt network integrity.
- Do not access or modify data that does not belong to you.
- Provide detailed reports with proof of concept and steps to reproduce.
Eligibility
To qualify for a bounty, submissions must meet the following criteria:- Report a previously unknown, non-public vulnerability within the program’s scope.
- Be the first to disclose the vulnerability.
- Provide sufficient information to reproduce and resolve the issue.
- Avoid exploiting the vulnerability or disclosing it publicly.
- Comply with all program rules and guidelines.
Prohibited Actions
The following actions are prohibited:- Testing on public mainnet/testnet deployments.
- Public disclosure of vulnerabilities without prior consent.
- Exploitation of vulnerabilities for personal gain.
- Engaging in illegal activities or coercive tactics.
Mediation Process for Bounties
To initiate mediation, you must set the finding’s status to Disputed in Cantina Code. That status triggers the process so Cantina can step in and help resolve the disagreement.Note: Only findings in Disputed status are eligible for mediation. If you disagree with a Rejected or Duplicate decision, set the finding to Disputed to request mediation.At Cantina, we foster a collaborative environment where researchers and clients can work together to resolve disputes in a fair and transparent manner.
1. Submission of Finding
- Researcher: Submits a finding.
- Client: Reviews the finding and provides feedback.
2. Disagreement
Disagreements may arise over:- Severity assessment.
- Finding validity.
3. Escalation to Cantina
If a resolution cannot be reached, either party can escalate the finding to Cantina for mediation.4. Triage and Solution Proposal
Cantina’s triaging team will:- Review the finding.
- Propose a fair solution based on the guidelines.
5. Final Decision
The client has the final say on the resolution.Client Rejection Policy
If a client rejects more than five findings in one year that we believe are valid, Cantina reserves the right to:- Conduct a thorough review of the client’s participation.
- Take necessary actions to ensure platform integrity.
Communication Guidelines During Mediation
- Direct Communication: Cease direct communication between parties during mediation.
- Reporting: Communicate all concerns to Cantina.
- Status Updates: Researchers can request updates through the relevant bug report thread.
FAQs
When will I get paid after my finding is confirmed?
Bounty payouts follow the weekly Tuesday cutoff / Wednesday batch. See Bug Bounty Payout and Payout Schedule & Process.Are duplicate findings paid in bug bounties?
No. Duplicate findings are not eligible for payment in bug bounty programs.Do I need a deposit for every bounty?
No. Only programs that show a deposit requirement on the bounty page. See Deposits for Bounty Submissions.By adhering to these guidelines and classifications, we ensure a fair and transparent process that benefits both researchers and clients, and fosters the growth of a secure and resilient ecosystem.