Security program
Find a flaw, tell us privately, get paid
Paxeer X moves real money for real software. If you find a way to break the limits, forge a receipt or move funds that are not yours, we want to hear it first, and we pay by severity.
Rewards
The reward depends on how bad the issue is. The ranges below are per tier, and we place a report in a tier by its impact, not by how hard it was to find.
| Severity | Reward |
|---|---|
| Critical | $10,000-$50,000Could move or destroy funds, let an agent spend outside the limits a person set, or change what the network considers final. |
| High | $5,000-$10,000A serious weakness in security or stability that does not on its own lead to loss of funds. |
| Medium | $1,000-$5,000Limited impact, or exploitable only under specific conditions. |
| Low | $100-$1,000Minor issues and informational findings. |
Scope
What qualifies for a reward, and what does not.
In scope
- Core protocol logic: consensus, transaction execution and the EVM
- Signed receipts and finality: anything that lets a receipt be forged or a committed block be changed
- Spending limits, allowlists, time windows, budgets and session keys enforced by the network
- Native payments: pay-per-call, exact payments, streams, escrow and service agreements
- Markets and programs: perpetuals and spot, token launches, and the program runtime
- The PaxPort wallet, including threshold signing, passkeys and recovery
- The official SDKs, CLI, MCP server and agent tooling
Out of scope
- Third-party services and integrations
- Issues that are already known or already reported
- Attacks that need a compromised private key
- Social engineering
- Denial-of-service attacks on infrastructure
Program rules
- Send reports to security@paxeer.app. Never post a suspected vulnerability in a public issue or chat.
- Do not exploit a vulnerability beyond a proof of concept, and never move funds that are not yours.
- Do not disclose the issue publicly until it is fixed.
- Each unique vulnerability earns one reward.
- If several people report the same issue, the first reporter gets the reward.
What a good report includes
- What is affected, and the version or commit you tested against
- Steps to reproduce, from a clean start
- Which guarantee breaks, and what an attacker could do with it
- Any fix or mitigation you can suggest
Found a vulnerability?
Send your findings privately to the security team. Keep it to a proof of concept, and keep it quiet until it is fixed. We confirm receipt and work the fix through with you.