Bitdo bitdo.ai/zh_CN

Bitdo concentrates Chinese-language crypto trading tools: real-time market data aggregation, AI-driven signal generation, automated bot execution, exchange API integrations, portfolio tracking, and admin dashboards — fertile ground for API key theft, unauthorized trade execution, signal manipulation, database compromise, and admin account takeover. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

Bitdo serves a significant Chinese-speaking user base, storing exchange API keys and trading configurations that can control substantial funds. A single SSRF, IDOR, SQLi, or authentication bypass on the platform can cascade into fund theft at scale. In scope materially: every host under bitdo.ai, the /zh_CN locale surface, AI signal infrastructure, bot execution engines, API integrations, WebSocket feeds, admin panels, and database surfaces. Civil exclusions only: fund theft against unrelated third parties, laundering, harassment — society-level bans, not endpoint lists.
Always keep sandbox mirrors humane: prove impact on isolated test accounts when possible.

A critical finding is one that leads to database compromise, admin account or console access, drainage of user funds (via stolen API keys, trade execution without consent, or signal manipulation), or any vulnerability enabling fund theft from the platform or its users.

• SQL injection, NoSQL injection, or any DB access path that exfiltrates credentials, API keys, or user data
• Authentication bypass granting admin-level access to the bitdo.ai control panel
• Server-side request forgery (SSRF) exposing internal infrastructure, secrets, or database endpoints
• Remote code execution (RCE) on bitdo.ai servers
• IDOR or privilege escalation allowing access to other users' API keys, trade bots, or portfolios
• Business logic flaws enabling unauthorized trade execution or fund movement across connected exchanges

Signal relay workers, bot execution daemons, monitoring dashboards, partner integration endpoints fronted by bitdo.ai — all eligible when critical impact reproduces.

• Vanity domains CNAME'd into Bitdo edge — show DNS/traffic proof in your write-up.
• Telegram/WeChat bot integrations that relay signals or accept trade commands
• Colocated automation containers Bitdo operates
• Staging or dev shards on bitdo.ai that mirror production
• Chinese third-party service integrations (WeChat Pay, Alipay, etc.) exposed via Bitdo

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing fund/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → treasury or book integrity break.
3. Minimize real-user blast radius. Prefer test accounts, low-value targets, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on bitdo.ai before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://bitdo.ai/zh_CN (security@bitdo.ai is a common guess — verify on the live site before emailing). Attach a clear kill-chain narrative along with replayable proof.

Unverifiable reports or those lacking demonstration of actual impact will be closed without reward.

// BUGGY: admin session cookie not scoped to path — /zh_CN/admin shares cookie with user surface
app.use(session({
  secret: 'hardcoded-secret-2024',
  cookie: { secure: true, httpOnly: true }
  // Missing: path, sameSite, and rolling regeneration
}));

async function getAdminDashboard(req, res) {
  // No CSRF token — session reuse between user and admin paths
  const users = await db.findAll('users');
  const keys = await db.findAll('api_keys');
  res.json({ users, keys });
}

A real submission would pair this with captured HTTP requests showing admin session hijacking via cookie reuse, then demonstrate exfiltration of all user API keys from bitdo.ai, enabling fund theft across connected exchanges.