PUBLIC BETALive on Solana mainnet. Not audited. Start small.Know the limits
Bunker
Launch app
Bug bountyPublic beta · not audited

It’s not a bug.It’s a bounty.

Bunker holds real funds on Solana mainnet and nobody has audited it. If you can break it, tell us first and get paid for it.

Report a vulnerabilityWhat counts
01THE BOUNTY VAULT
In the vaultBalance unavailableThe bounty wallet’s address has not been published yet.
Where the money comes from

Funded by creator rewards from the Bunker Mode coin ($BUNKER). Rewards flow into this wallet and pay for bug bounties and Bunker’s development.

The coin is not an investment and doesn’t unlock anything in Bunker. Nothing here is financial advice.

The figure is the wallet’s SOL balance, read from the network when you opened this page. It is not a promise of any payout.

02HOW TO REPORT

Five steps.
The second one is private.

Say which commit, how to reproduce it, and what it lets someone do. Leave out passwords, seed phrases and key files.

  1. 01

    Find it

    In the program, the site, the offline tool or the command-line client. All of it is open source.

  2. 02

    Report it privately

    Through GitHub’s private vulnerability report. Nobody else can read it.

  3. 03

    We confirm and fix

    We reproduce it, tell you what we found, and ship the fix.

  4. 04

    You get paid

    From the bounty vault, to the Solana address you give us.

  5. 05

    Public write-up

    After the fix has shipped, with your name on it if you want it there.

Report privately on GitHub
03 / THE RULES
  • Proof of concept only. Show that it works; don’t use it.
  • Never touch funds that aren’t yours.
  • Test on your own Bunker, with small amounts.
  • No public disclosure before the fix ships.
04WHAT COUNTS

Four tiers,
by what it lets someone do.

Payout amounts have not been set yet. They will be written here, and nowhere else, when they are.

  1. CriticalPayout: TBD

    Funds leave a Bunker without its owner’s keys, or its rules are bypassed.

    • Withdraw from a Bunker you don’t control.
    • Reuse or forge a one-time-key signature.
    • Bypass the trusted addresses or the waiting period.
    • Read a recovery kit’s secret out of the offline tool.
  2. HighPayout: TBD

    An owner loses control of a Bunker, or signs something they did not see.

    • Lock a Bunker’s funds so its owner can never withdraw them.
    • Make the site, the offline tool or the command-line client sign something other than what it showed.
    • Take a day key or its password out of the site, for example by running your own script on bunkermode.io.
    • Cancel or block someone else’s withdrawal or recovery.
  3. MediumPayout: TBD

    A Bunker is disrupted or misreported, and no funds move.

    • Stop one Bunker from working for a while.
    • Make an alert miss a withdrawal, or report one that did not happen.
    • Show a wrong balance or a wrong state that could lead an owner to a bad decision.
  4. LowPayout: TBD

    A real flaw with no path to anyone’s funds.

    • A gap in the page’s security policy that cannot be used yet.
    • A check that is weaker than the documentation says.
    • Wording that would mislead a careful reader about what is protected.

Not covered: other people’s wallets and apps, Solana itself, sites pretending to be Bunker, tricking a person rather than the software, and the coin. Already listed limits are on the security page; a way around one of them is still a finding.

05HALL OF FAME

The people who broke it first.

Nobody yet. The first name here could be yours.