Introduction
At GRVT, the security of our exchange, blockchain infrastructure, and Web3 applications is our highest priority. We welcome collaboration with the security research community and value responsible disclosures that help us protect our users’ data, funds, and trust.
This program outlines our focus areas, scope, submission process, and conditions for participating. While not every report will qualify for a bounty, we appreciate all contributions that help strengthen our security posture.
Focus Areas
Our program prioritizes vulnerabilities that directly affect the core security pillars of the exchange:
Confidentiality – Protection of user data, accounts, and funds.
Integrity – Prevention of unauthorized actions, data tampering, or logical flaws in critical flows.
Availability – Ensuring continuous, reliable operation of nodes, API servers, and exchange services.
In-scope examples:
Outages or logical errors on nodes or API servers.
Exploits affecting user accounts, authentication, or funds.
Web2 and Web3 vulnerabilities with real-world security impact.
Testnet findings are encouraged (rewarded at lower tiers than Mainnet).
Submission Process
Write a clear report including:
Step-by-step reproduction instructions
Proof-of-concept (minimal exploitation to demonstrate impact)
Screenshots, logs, or transaction hashes if applicable
A short assessment of potential impact
Submit reports to: [email protected]
If multiple people report the same bug, the first valid submission will be considered.
Rewards will be determined at GRVT’s discretion based on severity and impact.
We will not pursue legal action for good-faith research conducted in compliance with this program.
Prohibited Activity
To stay in scope, researchers must avoid:
Causing disruption or financial loss on Mainnet.
Phishing, social engineering, or blackmail.
Extended or large-scale denial-of-service attacks.
Exploiting vulnerabilities for personal financial gain beyond this program.
Publicly disclosing a bug before it is fixed.
Testing unrelated third-party services or integrations.
Research
Informational Reports
We value all reports, but some findings are generally considered low priority and may not qualify for rewards unless clear impact is demonstrated:
Missing HTTP headers without a clear exploit scenario
Clickjacking on non-sensitive pages
Self-XSS or logout CSRF
Information disclosure of non-sensitive data (e.g., version numbers, error messages)
Open redirects without impact
Automated scanner output without proof-of-concept
These reports are still welcome and help us track overall posture, but they may not qualify for bounties.
General Conditions
All submissions are evaluated at GRVT’s discretion.
GRVT reserves the right to change program terms, scope, and rewards at any time.
By submitting a report, researchers grant GRVT Security the right to use the information to improve platform security.