HalalMM (halalmm.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

HalalMM concentrates P2P trade creation, deposit holds, release authorization, dispute arbitration, fee accounting, chat mediation, admin overrides, and API-driven automation hooks — fertile ground for escrow theft, unauthorized release, dispute manipulation, and balance misaccounting the moment concurrency or authz weakens. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

The platform positions itself as a trusted middleman for crypto P2P trades: buyers deposit, sellers ship, HalalMM holds then releases. This design concentrates all custody risk into the escrow lifecycle — deposit tagging, hold ledger, release triggers, dispute overrides, fee splits — every link in that chain is a bounty-relevant attack surface. In scope materially: every host under halalmm.com and sibling subdomains they light up for P2P trading, API integrations, WebSocket trade feeds, mobile deep links, chat mediation, admin review consoles, notification workers, hot wallet policies, dispute automation.
Civil exclusions only: theft-as-a-service against counterparties outside the bounty program, harassment, indiscriminate draining — society-level bans, not endpoint lists.
Always keep sandbox mirrors humane: avoid mainnet fund theft even if you can; prove impact on isolated fixtures when possible.

A critical on HalalMM means escrow bypass, unauthorized release of held funds, dispute outcome manipulation with financial impact, mass balance disclosure, or persistent admin account takeover — anything that lets an attacker steal, freeze, or misdirect funds held in escrow, tamper with trade arbitration, or escalate privileges to the operator panel.

Sandbox escrow environments, canary wallet clusters, Grafana for dispute latency, Telegram/bot hooks for risk alerts, partner liquidity APIs fronted by HalalMM — all eligible when critical impact reproduces.

• Vanity domains CNAME'd into HalalMM edge — show DNS/traffic proof in your write-up.
• Escrow SDKs or bookmarklets HalalMM ships to traders
• Colocated market-making containers they operate
• Bridge or on-ramp callbacks verified with HalalMM-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing fund/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → escrow hold or release integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on halalmm.com before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers get acknowledged-only.

Use the security / vulnerability disclosure contact published on https://halalmm.com/ (security@halalmm.com is a common guess — verify on the live site before emailing).

All reports must include:

1. Summary and type of vulnerability
2. Numbered kill chain from entry to impact
3. Proof of successful exploitation (HAR, replayable cURL, screenshots with evidence)
4. Suggested remediation or hardening approach (optional but appreciated)

Illustrative race on escrow release + dispute check — worthless without request captures showing unauthorized fund release on halalmm.com.

// BUGGY: TOCTOU race — dispute check and release are not atomic
async function releaseEscrow(tradeId: string) {
  const trade = await db.getTrade(tradeId);
  if (trade.status !== 'held') throw new Error('invalid state');

  // Race window: attacker sends 20 parallel releaseEscrow() calls here
  const isDisputed = await db.hasActiveDispute(tradeId);
  if (isDisputed) throw new Error('disputed');

  await wallet.send(trade.buyerAddress, trade.amount); // each parallel call sends full amount
  await db.updateTrade(tradeId, { status: 'released' });
}