TradeAdapter (tradeadapter.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

TradeAdapter is a crypto trading optimizer that aggregates liquidity, executes arbitrage strategies, manages portfolio allocations, and routes orders through connected exchange APIs. The platform concentrates sensitive user funds in hot wallets, maintains extensive database stores of user credentials, API keys, trading histories, and wallet secrets, and exposes powerful admin consoles that can override trades, adjust fees, pause withdrawals, and modify system parameters — making fund theft, database compromise, and admin access escalation the three primary bounty targets. Each demonstrated critical earns $5,000.

In scope materially: tradeadapter.com every HTTP/S host, trading APIs (REST + WebSocket), admin dashboards, database endpoints (including exposed management interfaces), wallet/custody infrastructure, internal ledgers, user KYC/financial data stores, signing services, trade execution bots, monitoring/alerting systems, CI/CD pipelines, cloud metadata endpoints reachable from TradeAdapter workers, and any third-party connectors where TradeAdapter-issued credentials authenticate.
Civil exclusions only: blackmail, extortion, laundering, harming unrelated users — those are universal bans, not surface carve-outs.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel withdraw harnesses, WS replay dumps, signing traces, database query logs showing row-level data exfiltration).

Every system TradeAdapter operates or whose security depends on TradeAdapter-issued secrets is in scope. Below is the enumerated surface, but this list is indicative not exhaustive — the spirit of the bounty is any critical impact achievable through TradeAdapter's trust boundary.

Illustrative race condition on debit + enqueue payout — worthless without captures proving you can duplicate withdrawals on tradeadapter.com. The code below sketches the class of bug, not a specific finding.

// BUGGY: non-atomic balance check + debit — parallel requests double payout
async function requestWithdraw(userId, amount) {
  const bal = await db.getBalance(userId);
  if (bal < amount) throw new Error('insufficient');
  await db.debit(userId, amount);
  await queue.enqueuePayout(userId, amount);
}

// POC: send 10 parallel withdraw requests for the same user with the same amount
// If the balance check passes for all before any debit completes,
// each request enqueues a payout — draining more than the user's balance.

Send full reports to security@tradeadapter.com. Every submission must contain:

1. Attack chain — numbered sequence from attacker starting state to impact, with HTTP request/response pairs, code paths, and preconditions.
2. Reproduction script — curl, Python, Burp collection, or HAR proving the exploit works (not a hypothetical).
3. Severity justification — why this maps to TradeAdapter critical (fund theft, database breach, admin takeover).
4. Suggested remediation — input validation, access control fix, rate limiting, atomic operations.