Skip to main content
At Cantina, we prioritize the security and integrity of our ecosystem. Our Bug Bounty program aims to foster collaboration between researchers and clients to identify and resolve vulnerabilities before they can be exploited. See Bounty Severity Classification for how vulnerabilities are categorized and rewards are determined.

​
Getting Started

To participate in bug bounty programs you must:

​
Bounty Flow: From Submission to Payout

  1. Submit finding — researcher submits through Cantina Code.
  2. Triage — finding moves through statuses such as New and In Review (see Finding Statuses).
  3. Client review — client and triage confirm, reject, or mark duplicate.
  4. Confirmed — only Confirmed findings are eligible for payout.
  5. Payment: Eligible findings enter the payout process. See Bug Bounty Payout for requirements and Payout Process for payment statuses.

​
Testing Guidelines

To ensure responsible testing:
  • Use local forks instead of public chains.
  • Avoid actions that may disrupt network integrity.
  • Do not access or modify data that does not belong to you.
  • Provide detailed reports with proof of concept and steps to reproduce.

​
Eligibility

To qualify for a bounty, submissions must meet the following criteria:
  • Report a previously unknown, non-public vulnerability within the program’s scope.
  • Be the first to disclose the vulnerability.
  • Provide sufficient information to reproduce and resolve the issue.
  • Avoid exploiting the vulnerability or disclosing it publicly.
  • Comply with all program rules and guidelines.

​
Prohibited Actions

The following actions are prohibited:
  • Testing on public mainnet/testnet deployments.
  • Public disclosure of vulnerabilities without prior consent.
  • Exploitation of vulnerabilities for personal gain.
  • Engaging in illegal activities or coercive tactics.

​
Discuss findings on Cantina

All discussion about a submitted finding must happen on Cantina. Contacting the program client or its employees about it through any other channel may result in the finding being rejected with no reward and a ban from the Cantina platform.

​
Mediation Process for Bounties

To initiate mediation, you must set the finding’s status to Disputed in Cantina Code. That status triggers the process so Cantina can step in and help resolve the disagreement.
Note: Only findings in Disputed status are eligible for mediation. If you disagree with a Rejected or Duplicate decision, set the finding to Disputed to request mediation.
At Cantina, we foster a collaborative environment where researchers and clients can work together to resolve disputes in a fair and transparent manner.

​
1. Submission of Finding

  • Researcher: Submits a finding.
  • Client: Reviews the finding and provides feedback.

​
2. Disagreement

Disagreements may arise over:
  • Severity assessment.
  • Finding validity.

​
3. Escalation to Cantina

If a resolution cannot be reached, either party can escalate the finding to Cantina for mediation.

​
4. Triage and Solution Proposal

Cantina’s triaging team will:
  • Review the finding.
  • Propose a fair solution based on the guidelines.

​
5. Final Decision

The client has the final say on the resolution.

​
Client Rejection Policy

If a client rejects more than five findings in one year that we believe are valid, Cantina reserves the right to:
  • Conduct a thorough review of the client’s participation.
  • Take necessary actions to ensure platform integrity.

​
Communication Guidelines During Mediation

  • Direct Communication: Cease direct communication between parties during mediation.
  • Reporting: Communicate all concerns to Cantina.
  • Status Updates: Researchers can request updates through the relevant bug report thread.

​
FAQs

​
When will I get paid after my finding is confirmed?

Payout timing varies. Check your payment status in Cantina. If you have questions about a specific payout, use the relevant report thread or contact Cantina Support. See Bug Bounty Payout for requirements and Payout Process for help understanding your payment status.

​
Are duplicate findings paid in bug bounties?

No. Duplicate findings are not eligible for payment in bug bounty programs.

​
Do I need a deposit for every bounty?

No. Only programs that show a deposit requirement on the bounty page. See Deposits for Bounty Submissions.
By adhering to these guidelines and classifications, we ensure a fair and transparent process that benefits both researchers and clients, and fosters the growth of a secure and resilient ecosystem.