Dex (dex.fo) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

Dex.fo accumulates approval prompts, off-chain quote signatures, affiliate parameters, session state tied to wallets, indexer queries, and RPC proxying — fertile ground for approval-class UX bugs, route or quote manipulation, and cross-account data bleed. Each demonstrated critical earns $5,000.

In scope materially: every host on dex.fo and delegated subdomains, WebSocket channels they terminate, edge bundles, partner widgets, and workers computing quotes or relaying txs.
Civil exclusions only: laundering, harassment, unrelated theft — not endpoint shrinkage. Prefer testnets where possible.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel withdraw harnesses, WS replay dumps, signing traces…).

Rows below do not cap surface. Anything Dex.fo hosts, signs, matches, settles, or withdraws through counts as bounty ground. “Not listed” ≠ “out-of-scope.”

Sandbox books or pool clusters, Grafana, bot hooks for risk alerts, partner APIs fronted by Dex.fo — all eligible when critical impact reproduces.

• Vanity domains CNAME’d into Dex.fo edge — show DNS/traffic proof in your write-up.
• Wallet connector SDKs or bookmarklets Dex.fo ships
• Colocated market-making or liquidity pool containers they operate
• Bridge, on-ramp, or pool callbacks verified with Dex.fo-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing fund/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → treasury or book integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on dex.fo before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://dex.fo/ (security@dex.fo is a common guess — verify on the live site before emailing). Template below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — trader/treasury impact in one paragraph

# Severity self-classification → must map to Dex.fo critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session, API key tier, market symbol, account ID)
2. Entry primitive — HTTP/WS line + signature headers
3. Pivot(s) → privilege/order/withdraw escalation
4. Final hop → balance theft / forged payout / infra takeover equivalent

## Successful exploitation evidence
• Scripted replay showing ledger/withdraw impact
• Parallel request traces (race/double-spend)
• Custody or admin log lines proving attacker-forged intent accepted

## Reproduction package
Commands + fixtures + commit/patch SHAs

## Disclosure ack
Private channel only until Dex.fo clears publication

Illustrative client-trusted minOut — worthless without traces showing victim gets a worse route on dex.fo.

// BUGGY: trusts client-supplied minOut without server re-simulation
function buildSwapTx(quote) {
  return router.encodeSwap(quote.path, quote.minOutClient);
}