Community-powered security.
The BLINK Bug Bounty Program invites security researchers, developers, and white-hat hackers to identify and report vulnerabilities. We reward quality reports generously and handle every submission with confidentiality.
Rewards match impact.
Bounties are based on severity, quality of the report, and potential impact.
Minor issues with limited impact, such as informational findings or low-severity UI bugs.
Issues that could affect individual users or degrade service quality.
Significant vulnerabilities that could impact funds, consensus, or network integrity.
Catastrophic vulnerabilities that could cause massive fund loss or network failure.
What is in scope.
We are interested in vulnerabilities across the entire BLINK stack. Out-of-scope reports include social engineering, physical attacks, and already-public issues.
Smart contracts
Token contracts, compliance modules, staking, and governance contracts.
Consensus
Validator logic, slashing conditions, and block production mechanisms.
Bridges
Cross-chain messaging, asset wrapping, and bridge relayers.
Compliance modules
KYC/AML flows, oracle attestations, and regulator dashboard.
Web infrastructure
Official websites, APIs, documentation, and front-end applications.
Play by the rules. Stay safe.
These guidelines protect researchers, users, and the network.
Responsible disclosure
Report vulnerabilities privately and give the team reasonable time to fix them.
No public disclosure
Do not disclose issues publicly until a fix is deployed and the report is approved.
First-come-first-served
The first complete, valid report for a given vulnerability receives the bounty.
No exploitation
Do not exploit vulnerabilities, attack mainnet, or harm users or data.
From report to payout.
A clear timeline so you know what to expect after submitting a vulnerability.
Submit report
Send a detailed report through the secure submission channel with reproduction steps.
Triage
The security team validates severity and scope within 5 business days.
Fix + retest
The team patches the issue and asks the reporter to verify the fix.
Payout
Once verified, the bounty is paid in BLINK or stablecoin within 30 days.
Top security contributors.
Recognizing the researchers who have helped keep BLINK secure.