Nexwest runs a paid bug bounty for vulnerabilities that affect user funds or network integrity. Reports are triaged within two business days.
Scope
| Component | In scope |
|---|---|
| Execution engine | Matching, margin, funding, liquidation, vaults |
| Consensus client | Block production, finality, validator set |
| Bridge contracts | Deposits, withdrawals, asset mapping |
| EVM precompiles | Read precompiles, CoreWriter |
| Official frontend | Authentication, signing, transaction construction |
Out of scope: social engineering, spam, denial of service against public endpoints, third-party applications, and issues that require a compromised device.
Rewards
| Severity | Example | Reward |
|---|---|---|
| Critical | Direct loss of funds, consensus failure | Up to $1,000,000 |
| High | Theft under specific conditions, permanent freeze | $50,000–$250,000 |
| Medium | Temporary freeze, incorrect accounting | $5,000–$25,000 |
| Low | Information leak, UI-level issue | $500–$2,500 |
Rewards are paid in USDC. The final amount depends on impact, reproducibility, and the quality of the report.
Do not test on mainnet with real funds
Use testnet or a local fork. If a proof of concept requires mainnet state, stop and contact the team first. Exploiting a vulnerability for profit disqualifies the report.
Submit a report
Include:
- A clear description of the issue and the affected component.
- Reproduction steps or a proof-of-concept.
- The expected impact and the conditions required.
- Any suggested remediation.
Submit through the security portal listed in the footer, or email security@nexwest.app with a PGP key. Do not open a public GitHub issue.
Disclosure policy
- Acknowledgment: within 2 business days.
- Triage: within 5 business days.
- Fix target: critical issues within 72 hours; high issues within 14 days.
- Public disclosure: coordinated after the fix is deployed, usually 30–90 days after triage.
Safe harbor
Good-faith research that follows this policy will not be pursued legally. Do not access data that is not yours, do not move funds, and do not degrade the service for other users.