ALT5 Sigma (alt5sigma.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

ALT5 Sigma routes authenticated trader sessions through web UIs and APIs, matches orders on central limit order books, processes multi-asset crypto deposits and withdrawals, custody hot and cold wallets, emits real-time WebSocket market data, and enforces trading limits and risk controls — fertile ground for broken access control, order-book manipulation, withdrawal bypass, and cross-account state corruption if any boundary slips. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP(S) origin answering for alt5sigma.com and delegated subdomains, WebSocket streams they operate, order-matching engines, custody wallets, fiat/crypto gateway integrations, risk-control and compliance pipelines, mobile app API backends, trading UIs, and any staging or preview shards ALT5 Sigma labels.
Civil exclusions only: mass harassment, ransomware against unrelated third parties, laundering. Not product carve-outs.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows must exhibit (a) attacker-readable kill-chain storytelling and (b) objective proofs of successful exploitation replayable by ALT5 Sigma responders (Burp transcripts, scripted API sequences, SSRF egress captures, custody-bypass traces…).

These rows do not impose limits — shorthand for tagging reports. Anything ALT5 Sigma hosts, matches, custodies, verifies, or broadcasts counts as bounty ground even if undocumented here. Treat "not listed" ≠ "out-of-scope": default stance is open scope across ALT5 Sigma.

This playbook refuses "only these SKU endpoints." Staging shards, mirrored environments, admin panels, feature-flag planes, SMTP bridges, automation hooks ALT5 Sigma patches — all bounty eligible when critical impact is reproducible.

• Every apex / vanity hostname routing through ALT5 Sigma edge — claim routing evidence in your chain write-up.
• Mobile app API backends and SDK artifacts ALT5 Sigma ships toward production
• Real-time WebSocket market data streams they operate
• Partner OAuth or API-key consent surfaces ALT5 Sigma operates

1. Prove exploitation success. Ship artefacts third parties rerun: scripted curl flows, Burp/HAR exports, SSRF egress captures, custody-bypass scripts with verified state mutation.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (ATO, cross-account bleed, withdrawal reroute, infra takeover…).
3. Responsible blast radius documentation. Quantify users or accounts affected even when exercised only on staging mirrors that mirror routing + auth faithfully.
4. Encrypt & ship privately. Use sanctioned intake on alt5sigma.com (see submit section) before broadcasting exploit details.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on collisions.

Start from the security / disclosure contact publicly listed on alt5sigma.com (security@alt5sigma.com is a common pattern — verify on the vendor site before sending). Mandatory sections mirror below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to ALT5 Sigma critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session / API key / account context)
2. Entry primitive — exact HTTP verb/path/query/body
3. Pivot(s) chaining trust escalation
4. Final hop → ATO / cross-account damage / withdrawal reroute / infra takeover equivalent

## Successful exploitation evidence
• Replayable script + truncated responses showing impact
• HAR / Burp with unauthorized state change
• Withdrawal or custody logs proving forged operation accepted

## Reproduction package
Commands + fixtures + pinned SHAs

## Disclosure ack
Responsible channel only until ALT5 Sigma clears publication coordination

Pseudocode for withdrawal authz checks trusting unvalidated account IDs — useless without traces proving unauthenticated alt5sigma.com calls mutate protected state.

# BUGGY: withdrawal endpoint trusts client-supplied account_id without ownership check
@app.route('/api/v1/withdraw', methods=['POST'])
def withdraw():
    body = request.get_json()
    acct = body['account_id']      # attacker-controlled
    amt  = body['amount']
    addr = body['address']
    if not db.has_funds(acct, amt):
        raise InsufficientFunds()
    db.debit(acct, amt)
    broadcast_tx(addr, amt)       # attacker withdraws victim's funds