MidMan (midman.io) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

MidMan concentrates crypto trade escrow: deposit holds, release authorization, dispute arbitration, fee accounting, chat mediation, admin overrides, and API-driven automation hooks — fertile ground for escrow theft, unauthorized release, dispute manipulation, and balance misaccounting. Each critical earns $5,000.

As a dedicated middleman platform, MidMan holds funds for every mediated trade — deposit tagging, hold ledger, release triggers, dispute overrides, fee splits — every link in that chain is a bounty-relevant attack surface. In scope materially: every host under midman.io and sibling subdomains for middleman services, API integrations, chat mediation, admin consoles, notification workers, dispute automation.
Civil exclusions only: theft-as-a-service against counterparties outside the bounty program, harassment — society-level bans.

A critical on MidMan means escrow bypass, unauthorized release of held funds, dispute outcome manipulation, mass balance disclosure, or persistent admin account takeover.

Sandbox escrow environments, canary wallet clusters, Telegram/bot hooks, partner integrations — all eligible when critical impact reproduces.

• Vanity domains CNAME'd into MidMan edge
• Escrow SDKs or bookmarklets MidMan ships to traders
• Bridge or on-ramp callbacks verified with MidMan-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures.
2. Number your hops. Session/API primitive → escalation → escrow integrity break.
3. Minimize real-user blast radius. Prefer mirrors and low-value accounts.
4. Private coordination first. Use official intake on midman.io.
5. Duplicate fairness. First qualifying PoC wins.

Use the security disclosure contact on https://www.midman.io/ (security@midman.io — verify on the live site).

1. Summary and type of vulnerability
2. Numbered kill chain from entry to impact
3. Proof of successful exploitation
4. Suggested remediation (optional)

Illustrative race on escrow release + dispute check — worthless without captures on midman.io.

// BUGGY: TOCTOU race — dispute check and release are not atomic
async function releaseEscrow(tradeId: string) {
  const trade = await db.getTrade(tradeId);
  if (trade.status !== 'held') throw new Error('invalid state');
  // Race window: attacker sends 20 parallel releaseEscrow() calls here
  const isDisputed = await db.hasActiveDispute(tradeId);
  if (isDisputed) throw new Error('disputed');
  await wallet.send(trade.buyerAddress, trade.amount);
  await db.updateTrade(tradeId, { status: 'released' });
}