Moving or freezing user funds
Take, redirect or lock up funds that aren’t yours: spend a note twice, withdraw without a valid proof, or keep users from getting their money out.
The Veil Bug Bounty: up to $30,000
The Veil Bug Bounty is now open. Find a bug that puts our users at risk and earn up to $30,000.
98/100 on ContractWolf. Now it’s your turn.
What we’re paying for
Any bug that puts Veil’s users at risk
Breaking user privacy
Link a shield to the withdrawal it pays for, tie private activity back to a wallet, or reveal what someone holds, sends or trades.
Bypassing Veil’s security
Get around a check that protects users, anywhere it lives: in the on-chain program, the relayer, the app or the extension.
- Programveil-core · FmsMbX…oq9DP
- Relayerrelayer.veilit.xyz
- Appapp.veilit.xyz
- ExtensionVeil for Chrome
Rewards
Paid by impact, up to $30,000
- Move, steal or permanently freeze user funds
- Spend a note twice, or withdraw without a valid proof
- Link users’ shields to their withdrawals at scale
- Freeze funds or block withdrawals for a while
- Reveal one user’s private activity
- Get the relayer or extension to act without the user’s approval
- Leak private details (balances, amounts, addresses) to someone who shouldn’t see them
- Bypass a security check with limited impact
- A real weakness with little impact today that could combine into something worse
The Veil team sets the severity of each report by its real impact on users. A clear report with a working proof of concept earns more within its tier. Rewards are paid in USDC on Solana to the wallet you name.
Submit a finding
Report it here, sealed before it leaves your browser
Your report is encrypted on this page with Veil’s public key. Only the Veil team can open it: not our servers, not anyone in between, not even this page once it’s sent.
Prefer email? Write to info@veilit.xyz with the subject Bounty breach, and send the details through this form: email isn’t end-to-end encrypted.
Rules
Play fair, and we’ve got your back
The rules
- Test only with your own wallets and your own funds. Never touch anyone else’s.
- If you reach someone else’s data or funds, stop there and tell us. Don’t keep, change or share it.
- No denial of service, spam or load tests against Veil’s servers or the Solana network.
- No phishing or social engineering, and no attacks on Veil’s team or accounts.
- Keep it private until it’s fixed and we’ve agreed when to publish. We’ll credit you if you’d like.
- One report per bug. If two people find the same one, the first clear report is rewarded.
Out of scope
- Bugs in Solana itself or in third parties such as Jupiter, Phantom or pump.fun (we’ll still help you reach them)
- Attacks that need a compromised device, browser or seed phrase
- Volumetric denial of service, rate limits and spam
- Missing best-practice headers, self-XSS, or clickjacking on pages with no sensitive action
- The $VEIL token’s price or trading
- Issues already known to us, or that don’t reach a deployed version
Safe harbor
If you research in good faith and follow these rules, we consider your work authorized. We won’t pursue or support legal action against you for it, and we’ll work with you to understand and fix what you found.