Help us keep ChipaX secure
We appreciate security researchers who responsibly disclose vulnerabilities in our platform.
Submit a ReportEmail security@chipatrade.com with a PoC and reproduction steps.
Severity & RewardsProgram not yet active
- Remote code execution on ChipaX servers
- Authentication bypass giving access to any account
- Private key or seed phrase exposure
- Direct theft or freezing of user funds
- Privilege escalation to admin or staff roles
- SQL injection or mass data exposure
- Cross-site scripting with account takeover impact
- Order manipulation affecting other users
- Reflected XSS without account takeover
- Insecure direct object reference (limited impact)
- Information disclosure of non-sensitive data
- Rate-limiting bypass without financial impact
- Missing security headers
- Clickjacking on non-sensitive pages
- Verbose error messages leaking stack traces
- Outdated dependency without a known exploit
These tiers are the planned rewards for when the paid program launches — no monetary rewards are offered while it is inactive. Final amounts will be determined at our discretion based on exploitability, impact, and quality of the report, paid in USDC.
✓ In Scope
✕ Out of Scope
Rules
Disclosure Process
Submit
Email security@chipatrade.com with PoC, steps, and screenshots.
Triage
We acknowledge within 48 hours and assess severity.
Fix
We patch the vulnerability. Timeline depends on severity.
Credit
You are credited publicly once the fix is deployed. Paid rewards start when the program goes live.
Found something?
We're grateful for every responsible disclosure. Let's talk.