In Scope
Targets
Supra Blockchain Core, Consensus Protocol, Oracles, Smart Contracts, APIs, Developer Tools, Infrastructure, Website Applications.
Types
Code vulnerabilities, security loopholes, protocol flaws, including loss of funds, consensus failures, network halts, and more.
Severity & Rewards
Submission Guidelines
Eligibility
Must be the first reporter, within scope, and report within 24 hours of discovery.
Details
Testing Environment
Program Rules
Confidentiality
Do not disclose vulnerabilities publicly without Supra's consent.
Eligibility Criteria
- Report within 24 hours of discovery.
- Properly documented submission.
- Must not be a known vulnerability.
- Must be the first reporter.
- Must be within scope.
- Not a current or former Supra employee within the last 12 months.
- Make every effort to avoid privacy violations and disruption of services.
- KYC required for rewards.
Response Times
First Response: 7d
Triage Time: 14d
Resolution Time: 30d
Reward Time: 90d
Payouts
Rewards will be paid in digital assets determined by the team. Payouts for experimental features or incomplete reports may be reduced.
Responsible Disclosure: Supra adheres to Category 3 for Responsible Publication. All vulnerabilities must remain confidential until resolved.
Invalid Bug Reports
- Self-exploited attacks.
- Governance/admin privilege attacks.
- Social Engineering attacks
- Attacks requiring leaked credentials.
- Oracle manipulation flash loan attacks and more.
- Denial of Service attacks
The following are for reference only and do not cover all invalid bug reports
Privacy • Terms of Use • Website Data Usage & Cookies • Bug Disclosure • Biometric Information Privacy Policy
©2025 Supra | Entropy Foundation (Switzerland: CHE.383.364.961). All Rights Reserved