> ## Documentation Index
> Fetch the complete documentation index at: https://docs.o1.exchange/llms.txt
> Use this file to discover all available pages before exploring further.

# Bug Bounty Program

> Help secure o1.exchange and earn rewards for finding vulnerabilities

## Protecting Our Community

At o1.exchange, security is our top priority. We've established a comprehensive bug bounty program to incentivize security researchers and developers to help identify vulnerabilities in our platform. Your contributions help us maintain the highest security standards for our users.

<CardGroup cols={2}>
  <Card title="Report Vulnerabilities" icon="bug">
    Discover and report security issues to earn rewards
  </Card>

  <Card title="Earn Rewards" icon="coins">
    Get paid for valid security findings based on severity
  </Card>
</CardGroup>

## Reward Structure

<Tabs>
  <Tab title="Severity Levels">
    Rewards are determined based on the severity and impact of the vulnerability:

    | Severity   | Description                                  | Reward Range    |
    | ---------- | -------------------------------------------- | --------------- |
    | **High**   | loss of funds, significant impact            | $1,000 - $5,000 |
    | **Medium** | Limited impact, requires specific conditions | $500 - $1,000   |
    | **Low**    | Minimal impact, informational issues         | $100 - $500     |
  </Tab>

  <Tab title="Scope">
    ### In Scope

    * Smart contract vulnerabilities
    * Trading engine exploits
    * Authentication bypass
    * Fund manipulation
    * Oracle manipulation
    * Cross-site scripting (XSS)
    * SQL injection
    * Remote code execution

    ### Out of Scope

    * Known issues or already reported vulnerabilities
    * Social engineering attacks
    * Physical attacks
    * Denial of service attacks
    * Issues in third-party services
    * Generic product bugs, including but not limited to UI/UX, application clients, product stability, etc.
  </Tab>
</Tabs>

<Warning>
  * Attempting to exploit vulnerabilities on the mainnet or causing actual harm to users is strictly prohibited and may result in legal action.
  * No one should break nor exploit the mainnet (production o1.exchange site) without the admin/team's approval; otherwise it would lead to a smaller final payout.
</Warning>

## How to Participate

<Steps>
  <Step title="Discover">
    Review our smart contracts, trading platform, and infrastructure for potential vulnerabilities
  </Step>

  <Step title="Document">
    Create a detailed report including:

    * Clear description of the vulnerability
    * Steps to reproduce
    * Impact assessment
    * Suggested fix (if applicable)
    * Payments would be sent when attack and solution documentations are shared, given no follow-up attack within the next 1 month
  </Step>

  <Step title="Submit">
    Send your report to our X account @o1\_exchange via DM
  </Step>

  <Step title="Review">
    Our security team will review your submission within 48 hours
  </Step>

  <Step title="Reward">
    Upon validation, receive your bounty payment in USDC or ETH
  </Step>
</Steps>

## Recognition

<Note>
  Top contributors to our bug bounty program will be featured in our Security Hall of Fame and receive exclusive NFT badges recognizing their contributions to platform security.
</Note>

## Legal Safe Harbor

We commit to not pursuing legal action against security researchers who:

* Comply with this bug bounty policy
* Act in good faith
* Make a reasonable effort to avoid privacy violations
* Do not exploit vulnerabilities beyond what's necessary for verification

<Tip>
  Join our security-focused Discord channel to discuss potential findings with our team and other security researchers. Remember: collaboration makes our platform stronger!
</Tip>

## Contact

For questions about the bug bounty program or to submit a vulnerability report:

<Card title="Security Team" icon="envelope">
  **Twitter**: Send your report to our X account @o1\_exchange via DM.\
  **Response Time**: Within 48 hours.
</Card>