Jupiter (jup.ag) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

Jupiter is the most-used decentralized exchange (DEX) aggregator on Solana, routing massive swap volume through many liquidity integrations. This bounty model is blunt: hunters map the widest possible perimeter, disclose fully, and compete on end-to-end critical exploitation quality — each confirmed critical pays $5,000.

Eligible surface: every smart contract Jupiter authors, aggregator & supporting programs, frontend & background workers, signer flows, quoting & routing infra, wallets / SDK wrappers maintained by Jupiter, partner-hosted Jupiter plugins when Jupiter controls patches, release pipelines, binaries, dashboards, bots, caches, build servers, telemetry collectors, staging & research environments mirrored for repro, CI secrets only if surfaced through their stack — if Jupiter can patch it or owns accountability, hunters can chase it until triage rejects it.
Excluded only by necessity: crimes (extortion, user harassment), harming unrelated third‑party infra you do not legitimately audit, spam without signal. Those are societal/legal limits — not narrower “business scope” exclusions.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USDC each. Non-critical novelty might receive coordination credit or internal tracking, but not this cash line — focus ruthlessly on chain-ending impact. Every paid report must simultaneously ship (a) attacker-language kill chain narration and (b) objective proof that the exploit path succeeded (see submission template fields).

These rows do not impose limits — they're convenient handles for writing reports. Anything Jupiter fingerprints as theirs is bounty terrain even if omitted below. Treat “not listed” ≠ “out-of-scope”: default stance is open scope.

This program intentionally rejects shrunken allow-lists. If Jupiter can remediate via code/config/process ownership, hunters may test it for critical-impact chains without hunting for somebody else’s carve-out appendix.

• All production + staging nets Jupiter labels theirs (including ephemeral QA)
• Open-source/private repos patched by Jupiter engineers
• Vendor SaaS knobs they administrate where breach routes through Jupiter SSO
• Third-party WASM modules Jupiter ships signed inside their UX
• Partner plugins only when Jupiter merges fixes (coordinate disclosure if counterpart needs PR)

1. Prove exploitation success. Dry essays fail. Ship artifacts that independently reproduce attacker victory (ledger state diff, scripted CLI, deterministic fuzz loop, reproducible txs).
2. Articulate kill chain granularity. Number each hop across trust boundaries → crypto → economic effect; reviewers must reconstruct without guessing.
3. Responsible blast radius documentation. Quantify hypothetical user capital exposure even if exercised only on forks/sandboxes aligned with Jupiter reality.
4. Encrypt & ship privately. Use sanctioned intake (security mail / advisories — see submit section) prior to tweeting exploits.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on equal severity collisions.

Transmit through security@jup.ag / private GitHub advisory per Jupiter’s rotating guidance. Mandatory sections:

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to Jupiter critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions / wallets / configs
2. Entry primitive (specific line / pubkey / REST path)
3. Pivot(s) chaining trust escalation
4. … final hop → theft / outage / irrevocable misuse

## Successful exploitation evidence (attach proofs)
• Transaction signatures (mainnet-canary acceptable if sanctioned; else IDENTICAL cloned-state fork)
• Ledger slot + program logs excerpts
• Hash of exploit repo tag + Dockerfile one-liners
• Or screen capture with signed CLI transcript + deterministic seeds

## Reproduction package
Commands + fixture download links + pinned commit SHAs


## Disclosure ack
Responsible channel only until Jupiter clears publication date

Below code is insufficient alone — pair it with a harness proving transactions land in a fork mirroring Jupiter program layout.

// PoC: missing authority check on `withdraw_fees`
use anchor_lang::prelude::*;

#[program]
pub mod vulnerable_program {
    use super::*;

    pub fn withdraw_fees(ctx: Context<WithdrawFees>) -> Result<()> {
        // BUG: no `has_one = authority` constraint below — anyone can call.
        let vault = &ctx.accounts.vault;
        let recipient = &ctx.accounts.recipient;

        **recipient.try_borrow_mut_lamports()? += vault.to_account_info().lamports();
        **vault.to_account_info().try_borrow_mut_lamports()? = 0;
        Ok(())
    }
}

#[derive(Accounts)]
pub struct WithdrawFees<'info> {
    #[account(mut)]
    pub vault: Account<'info, Vault>,
    #[account(mut)]
    pub recipient: Signer<'info>,
    // FIX: add `pub authority: Signer<'info>,` and `has_one = authority` above.
}