BitFix (bitfix.pro) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

BitFix concentrates open sessions, signed API keys, order-matching or synthetic book state, deposit tagging, withdrawal reconciliation, webhook or callback integrity, hot‑wallet policy thresholds, and staff tooling that can freeze or release funds — fertile ground for balance manipulation, cross-account bleed, and withdrawal races the moment concurrency or authz weakens. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

The venue markets itself as non‑KYC: onboarding friction stays purposefully low for traders, but that only increases reliance on session + custody correctness — not an invitation for testers to launder or harm unrelated custodial banks. In scope materially: every host under bitfix.pro and sibling subdomains they light up for trading/APIs, market-data WebSockets, mobile deep links, custody/bank integrations BitFix controls, historical market DB shards, risk cron jobs, signing services. Civil exclusions only: theft-as-a-service against counterparties outside the bounty program, harassment, indiscriminate ransomware — society-level bans, not endpoint lists.
Always keep sandbox mirrors humane: avoid mainnet fund theft even if you can; prove impact on isolated fixtures when possible.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel withdraw harnesses, WS replay dumps, signing traces…).

Rows below do not cap surface. Anything BitFix hosts, signs, matches, settles, or withdraws through counts as bounty ground. “Not listed” ≠ “out-of-scope.”

Sandbox order books, canary wallet clusters, Grafana for matching latency, Telegram/bot hooks for risk alerts, partner liquidity APIs fronted by BitFix — all eligible when critical impact reproduces.

• Vanity domains CNAME’d into BitFix edge — show DNS/traffic proof in your write-up.
• Wallet connector SDKs or bookmarklets BitFix ships to traders
• Colocated market-making containers they operate
• Bridge or on-ramp callbacks verified with BitFix-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing fund/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → treasury or book integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on bitfix.pro before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://bitfix.pro/ (security@bitfix.pro is a common guess — verify on the live site before emailing). Template below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — trader/treasury impact in one paragraph

# Severity self-classification → must map to BitFix critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session, API key tier, market symbol, account ID)
2. Entry primitive — HTTP/WS line + signature headers
3. Pivot(s) → privilege/order/withdraw escalation
4. Final hop → balance theft / forged payout / infra takeover equivalent

## Successful exploitation evidence
• Scripted replay showing ledger/withdraw impact
• Parallel request traces (race/double-spend)
• Custody or admin log lines proving attacker-forged intent accepted

## Reproduction package
Commands + fixtures + commit/patch SHAs

## Disclosure ack
Private channel only until BitFix clears publication

Illustrative race on debit + enqueue — worthless without packet captures proving two withdrawals settle from one balance on bitfix.pro.

// BUGGY: non-atomic balance check + debit — parallel wins double payout
async function requestWithdraw(userId, amount) {
  const bal = await db.getBalance(userId); // read
  if (bal < amount) throw new Error('insufficient');
  await db.debit(userId, amount);            // write — needs DB lock / serializable txn
  await queue.enqueuePayout(userId, amount);
}