Bitunix Web: Program info

IN-SCOPE VULNERABILITIES (WEB)

We are interested in the following vulnerabilities: Critical

• Remote code execution (RCE)
• Business logic issues can theft a lot of funds
• False top-up issues
• Leakage of sensitive information with a massive amount (KYC)
• Other security vulnerabilities that we consider to be critical High
• Business logic issues can lead to user fund loss
• Injection vulnerabilities (SQL, XXE)
• Access Control Issues (IDOR, Privilege Escalation, etc) can theft user funds.
• Leakage of sensitive information with a small amount (KYC)
• Server-Side Request Forgery (SSRF)
• Other security vulnerabilities that we consider to be high Medium
• Cross-Site Scripting (Stored XSS)
• Leakage of information（Email, Uid...）
• Business logic issues can lead to denial of service
• Other security vulnerabilities that we consider to be medium Low
• Directory traversal
• Leakage of information（System log, tracking data...）
• Cross-Site Scripting (Reflection XSS)
• Cross-Site Request Forgery (CSRF)
• Open redirects
• Other security vulnerabilities that we consider to be low

IN-SCOPE VULNERABILITIES (Mobile)

We are interested in the following vulnerabilities: Critical

• Remote code execution (RCE)
• Authentication bypass (biometric / passcode lock / 2FA / withdrawal verification) leading to account takeover or theft of user funds without high interactivity
• JSBridge / JavascriptInterface (Android) / WKScriptMessageHandler (iOS) exposure that allows untrusted pages or domains to invoke sensitive methods (e.g., obtain session tokens, place orders, transfer or withdraw funds) without high interactivity
• Account takeover via the mobile app (e.g., hijacking of OAuth/login callbacks through URL schemes or universal links / app links)
• Other vulnerabilities with comparable impact, at our discretion High
• Leakage of sensitive data without root/jailbreak or physical access. Sensitive data includes session tokens, private keys/mnemonics, passwords, API keys, KYC data, and other users' personal information
• Hard-coded secrets with demonstrable impact (e.g., cloud storage AK/SK, push service server keys, API signing keys, internal service tokens, payment keys)
• Insecure WebView configuration with a working exploit (e.g., arbitrary file read via file:// access, universal file access from file URLs)
• Exported components (Activity/Service/Broadcast Receiver/Content Provider) or intent redirection that leak sensitive data or perform sensitive actions
• Insecure local storage readable by other apps on non-rooted devices (e.g., tokens in external storage or world-readable files)
• Client-side input that leads to server-side injection (e.g., SQL injection) is evaluated under the Web/API scope
• Remote, persistent DoS that renders the app unusable until reinstalled
• Other vulnerabilities with comparable impact, at our discretion Medium
• Reflected XSS within app WebViews (rated higher if it can reach sensitive JSBridge methods)
• Unrestricted arbitrary URL loading via deeplink / URL scheme / universal link / app link without further impact
• Biometric / passcode lock bypass requiring physical access to an unlocked or locked device, without direct fund loss
• Remote DoS that can be repeatedly triggered and requires an app restart
• Client-side SQL injection in local databases with demonstrable sensitive impact
• Other vulnerabilities with comparable impact, at our discretion Low
• Phishing via WebView (e.g., URL/address bar spoofing, misleading title) without further impact
• Sensitive data (passwords, mnemonics, private keys, 2FA codes) written to the system clipboard without user intent or auto-clearing
• Other vulnerabilities with comparable impact, at our discretion

IN-SCOPE Threat Intelligence

The following types of threat intelligence findings are considered in-scope and eligible for rewards when they demonstrate a clear, actionable risk to Bitunix Exchange, its users, or its brand. Submissions must include verifiable evidence (screenshots, URLs, sample communications, malware hashes, etc.) and a clear explanation of the impact.

• Phishing websites and domains that impersonate the Exchange (including look-alike domains, fake login portals, fake KYC pages, or fake customer support sites).
• Fake mobile applications (Android/iOS) distributed outside official app stores that impersonate the official Exchange app or claim to offer trading, deposits, withdrawals, or customer support on behalf of the Exchange.
• Social media and messaging platform impersonation (Twitter/X, Telegram, Discord, Facebook, Instagram, WhatsApp, etc.) involving fake official accounts, support channels, or community groups that actively attempt to defraud users.
• Malicious advertising and SEO poisoning campaigns that promote fake Exchange-related pages, fake airdrops, or fake giveaways.
• Targeted malware, phishing kits, or credential-stealing infrastructure specifically designed to target Exchange users (including but not limited to fake wallet connection prompts, fake browser extensions, or info-stealers configured for Exchange domains).
• Active fraud campaigns (including investment scams, fake recovery services, or “account verification” scams) that misuse the Exchange’s name, logo, or branding.
• Leaked or exposed sensitive operational data that can be leveraged by threat actors against the Exchange or its users (e.g., internal employee credentials found in the wild, exposed threat intelligence feeds related to the Exchange, or compromised partner infrastructure directly affecting Exchange security).
• Supply-chain or third-party threats that directly impact the Exchange’s users or systems when clear evidence of active exploitation or high likelihood of exploitation is provided.

Bonus

• Extreme Up to $50,000 (Based on the final assessment by the Bitunix security team.)
• Critical $5,000 - $10,000 (Bonus: $1,000-$5000)
• High $1000 - $3,000 (Bonus: 0-$1,000)
• Medium $200 - $300
• Low $50 - $150

OUT OF SCOPE

WEB VULNERABILITIES

Vulnerabilities found in out of scope resources are unlikely to be rewarded unless they present a serious business risk (at our sole discretion). In general, the following vulnerabilities do not correspond to the severity threshold: Web

• Vulnerabilities in third-party applications
• Assets that do not belong to the company
• Best practices concerns
• Recently (less than 15 days) disclosed 0-day vulnerabilities
• Vulnerabilities affecting users of outdated browsers or platforms
• Social engineering, phishing, physical, or other fraud activities
• Publicly accessible login panels without proof of exploitation
• Reports that state that software is out of date/vulnerable without a proof of concept
• Reports generated by scanners or any automated or active exploit tools
• Vulnerabilities involving active content such as web browser add-ons
• Most brute-forcing issues without clear impact
• Theoretical issues
• Broken links
• Moderately Sensitive Information Disclosure
• Spam (sms, email, etc)
• Missing HTTP security headers
• Infrastructure vulnerabilities, including:
• Certificates/TLS/SSL-related issues;
• DNS issues (i.e. MX records, SPF records, DMARC records etc.);
• Server configuration issues (i.e., open ports, TLS, etc.)
• Session fixation
• User account enumeration
• Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking
• Descriptive error messages (e.g. Stack Traces, application or server errors)
• Self-XSS that cannot be used to exploit other users
• Login & Logout CSRF
• Weak Captcha/Captcha Bypass
• Lack of Secure and HTTPOnly cookie flags
• Usename/email enumeration via Login/Forgot Password Page error messages
• CSRF in forms that are available to anonymous users (e.g. the contact form)
• OPTIONS/TRACE HTTP method enabled
• Host header issues without proof-of-concept demonstrating vulnerability
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Content Spoofing without embedded links/HTML
• Reflected File Download (RFD)
• Mixed HTTP Content
• HTTPS Mixed Content Scripts
• Manipulation with Password Reset Token
• MitM and local attacks

Mobile App

• Vulnerabilities that require a rooted/jailbroken device, including runtime manipulation with tools such as (but not limited to) Frida, Xposed, or Appmon
• Vulnerabilities that require physical access to the user's device (except biometric/passcode lock bypass, see in-scope)
• Vulnerabilities requiring extensive user interaction (see Section 2)
• Lack of obfuscation, binary protection, anti-debugging, or root/jailbreak detection
• Certificate pinning bypass on rooted/jailbroken devices
• Lack of exploit mitigations, e.g., PIE or stack canaries
• Path disclosure in the binary
• Hard-coded keys that are public by design (e.g., OAuth client IDs, analytics or map SDK keys) or have no demonstrable impact
• One-off local crashes caused by malformed URL schemes or intents sent to exported components (remote/persistent DoS and sensitive data leakage via these components remain in scope)
• Shared links leaked through the system clipboard (sensitive data remains in scope, see Low)
• Screenshots, screen recording, or app-switcher snapshots
• android:allowBackup enabled or exported components without security impact
• Tapjacking or task hijacking (e.g., StrandHogg) without impact on sensitive operations
• Known vulnerabilities in third-party SDKs or libraries without a working PoC against our app
• Issues only reproducible on outdated OS versions, outdated app versions, or unofficial builds

Threat Intelligence

The following are considered out-of-scope and will not be eligible for rewards:

• General spam, unsolicited marketing, or low-quality phishing that does not specifically impersonate the Exchange.
• Social media accounts or domains that are merely parked, inactive, or have no evidence of active user targeting.
• Publicly available open-source intelligence (OSINT) that does not demonstrate a new or previously unknown threat to the Exchange.
• Theoretical threats, speculative analysis, or “what-if” scenarios without concrete evidence of active infrastructure or campaigns.
• Vulnerabilities or threats affecting third-party services that do not directly impact the Exchange’s users or systems (e.g., issues on unrelated crypto projects, exchanges, or wallets).
• Issues that require social engineering of Exchange employees or users to be exploited.
• Denial-of-service, spam, or flooding of Exchange systems or communication channels.
• Findings that rely solely on publicly available information already known to the Exchange’s security team.
• Physical security issues, insider threats without technical evidence, or threats that cannot be independently verified.
• Automated or bulk submissions of domains/apps without meaningful analysis or evidence of active malicious intent.

Access

• Targets are accessible via the public internet.

Credentials

• Please sign up for an account using your email address, and if you want access all product features , you need to pass Bitunix's KYC certification.

Notice

• Avoid using web application scanners for automatic vulnerability searching which generates massive traffic
• Make every effort not to damage or restrict the availability of products, services, or infrastructure
• Avoid compromising any personal data, interruption, or degradation of any service
• Don’t access or modify other user data, localize all tests to your accounts
• Perform testing only within the scope
• Don’t exploit any DDoS vulnerabilities, social engineering attacks, or spam
• Don’t spam forms or account creation flows using automated scanners
• In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
• Don’t break any law and stay in the defined scope
• Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission
• Any AI-generated report that has not been independently verified by the researcher will not be considered valid and may be rejected. A working, reproducible proof of concept is required.

Submission Requirements for Threat Intelligence Reports

• Provide clear, reproducible evidence.
• Include indicators of compromise (IoCs) where applicable (domains, IPs, hashes, Telegram handles, etc.).
• Describe the potential or observed impact on Exchange users.
• Do not interact with or attempt to compromise any systems beyond what is necessary for verification.
• Do not contact affected users or publicly disclose the finding before the Exchange has had a reasonable opportunity to respond.

We are happy to thank everyone who submits valid reports which help us improve security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, including attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of ours or one of its contractors.
• ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
• Provide detailed but to-the point reproduction steps

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial, is allowed for the moment.
• Please do NOT publish/discuss bugs