Ondo Finance
Ondo Perps Bug Bounty
active
02 Jun - TBA
Ondo Perps is a permissionless perpetual futures platform for equities, indices, and commodities powered by Ondo Finance. It allows users to trade with up to 20x leverage using tokenized stocks and ETFs as collateral. To fortify its infrastructure, the protocol has launched a continuous bug bounty program on the Cantina platform. Security researchers can hunt for vulnerabilities across the trading web app, website, and API. Participants can earn up to $1,500,000 in USDC for discovering critical flaws, with payouts determined by severity and the potential risk of fund loss.
Ondo Finance - Ondo Perps Bug Bounty Overview
How to join Ondo Finance - Ondo Perps Bug Bounty?
The Ondo Perps Bug Bounty is an ongoing security initiative launched via Ondo Perps and hosted on Cantina, focused on fortifying the permissionless perpetual futures platform. The program explicitly targets the full-stack web infrastructure, including the trading web app, website, and API. Successful security researchers are rewarded in USDC on the Ethereum network, with payouts calculated based on vulnerability severity and the potential risk of fund loss.
Prize allocations are structured around a severity tier ceiling. For vulnerabilities involving the potential loss or theft of funds, payouts are generally calculated using 10% of the reasonably estimated funds at risk, capped at the maximum tier limits. Critical vulnerabilities can earn up to $1,500,000, while High impact bugs are capped at $100,000. Medium and Low severity issues offer maximum rewards of $20,000 and $1,000 respectively.
To participate, researchers must submit detailed Proof of Concept reports outlining the reproduction steps and potential implications as soon as possible. Because this bounty is operated by Ondo Global (Panama) Inc., any validated finding requires the submitter to pass a mandatory KYC compliance check - including identity and address verification - before the final invoice is processed and distributed.
Step-by-step Guide
Register as a researcher on Cantina and complete the required $20 deposit.
Review the full scope, prohibited actions, and severity definitions for the trading web app and API targets.
Submit vulnerabilities directly through the dashboard with a clear description and a reproducible Proof of Concept.
Complete the mandatory KYC compliance checks - including identity and address verification - to qualify for payouts.
Await the triage and validation process by the security team for invoice generation and reward distribution.