ZenLand (zen.land) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

ZenLand concentrates peer-to-peer trade listings, offer creation, escrow deposits, release authorization, dispute arbitration, fee accounting, chat mediation, and API-driven automation hooks — fertile ground for escrow theft, unauthorized release, dispute manipulation, and balance misaccounting. Each critical earns $5,000.

As a P2P marketplace, ZenLand holds funds in escrow for every trade — deposit tagging, hold ledger, release triggers, dispute overrides, fee splits — every link in that chain is a bounty-relevant attack surface. In scope materially: every host under zen.land and sibling subdomains they light up for P2P trading, API integrations, WebSocket trade feeds, chat mediation, admin review consoles, notification workers, hot wallet policies, dispute automation.
Civil exclusions only: theft-as-a-service against counterparties outside the bounty program, harassment, indiscriminate draining — society-level bans, not endpoint lists.
Always keep sandbox mirrors humane: avoid mainnet fund theft even if you can; prove impact on isolated fixtures when possible.

A critical on ZenLand means escrow bypass, unauthorized release of held funds, dispute outcome manipulation with financial impact, mass balance disclosure, or persistent admin account takeover — anything that lets an attacker steal, freeze, or misdirect funds held in escrow, tamper with trade arbitration, or escalate privileges to the operator panel.

Sandbox escrow environments, canary wallet clusters, Telegram/bot hooks for risk alerts, partner liquidity APIs fronted by ZenLand — all eligible when critical impact reproduces.

• Vanity domains CNAME'd into ZenLand edge — show DNS/traffic proof in your write-up.
• Escrow SDKs or bookmarklets ZenLand ships to traders
• Colocated market-making containers they operate
• Bridge or on-ramp callbacks verified with ZenLand-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing fund/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → escrow hold or release integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on zen.land before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers get acknowledged-only.

Use the security / vulnerability disclosure contact published on https://zen.land/ (security@zen.land is a common guess — verify on the live site before emailing).

All reports must include:

1. Summary and type of vulnerability
2. Numbered kill chain from entry to impact
3. Proof of successful exploitation (HAR, replayable cURL, screenshots with evidence)
4. Suggested remediation or hardening approach (optional but appreciated)

Illustrative race on escrow release + dispute check — worthless without request captures showing unauthorized fund release on zen.land.

// BUGGY: TOCTOU race — dispute check and release are not atomic
async function releaseEscrow(tradeId: string) {
  const trade = await db.getTrade(tradeId);
  if (trade.status !== 'held') throw new Error('invalid state');

  // Race window: attacker sends 20 parallel releaseEscrow() calls here
  const isDisputed = await db.hasActiveDispute(tradeId);
  if (isDisputed) throw new Error('disputed');

  await wallet.send(trade.buyerAddress, trade.amount); // each parallel call sends full amount
  await db.updateTrade(tradeId, { status: 'released' });
}