LocalCoinSwap (localcoinswap.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

LocalCoinSwap concentrates peer-to-peer crypto trading: trade listings, escrow deposits, release authorization, dispute arbitration, fee accounting, chat mediation, and API automation — fertile ground for escrow theft, unauthorized release, dispute manipulation. Each critical earns $5,000.

As a P2P exchange, LocalCoinSwap holds funds in escrow for every trade — deposit tagging, hold ledger, release triggers, dispute overrides, fee splits — every link in that chain is a bounty-relevant attack surface. In scope materially: every host under localcoinswap.com and subdomains for trading, APIs, chat mediation, admin consoles, dispute automation.
Civil exclusions only: theft-as-a-service against counterparties, harassment — society-level bans.

Sandbox escrow environments, canary wallets, Telegram/bot hooks, partner APIs fronted by LocalCoinSwap — all eligible.

• Vanity domains CNAME'd into LocalCoinSwap edge
• Escrow SDKs or bookmarklets shipped to traders
• On-ramp callbacks verified with LocalCoinSwap secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures.
2. Number your hops. Session/API primitive → escrow integrity break.
3. Minimize real-user blast radius. Prefer mirrors.
4. Private coordination first. Use official intake on localcoinswap.com.
5. Duplicate fairness. First qualifying PoC wins.

Use the security disclosure contact on https://localcoinswap.com/ (security@localcoinswap.com — verify on the live site).

1. Summary and type of vulnerability
2. Numbered kill chain from entry to impact
3. Proof of successful exploitation

Illustrative race on escrow release + dispute check — worthless without captures on localcoinswap.com.

// BUGGY: TOCTOU race — dispute check and release are not atomic
async function releaseEscrow(tradeId: string) {
  const trade = await db.getTrade(tradeId);
  if (trade.status !== 'held') throw new Error('invalid state');
  const isDisputed = await db.hasActiveDispute(tradeId);
  if (isDisputed) throw new Error('disputed');
  await wallet.send(trade.buyerAddress, trade.amount);
  await db.updateTrade(tradeId, { status: 'released' });
}