KuCoin is a global cryptocurrency exchange for numerous digital assets and cryptocurrencies. Launched in September 2017, KuCoin has grown into one of the most popular crypto exchanges and already has over 8 million registered users across 207 countries and regions around the world.
Target | Type | Severity | Reward |
---|---|---|---|
KuCoin Mobile Application for Android Copy Copied https://www.kucoin.com/download | Android | Critical | Bounty |
KuCoin Mobile Application for iOS Copy Copied https://www.kucoin.com/download | iOS | Critical | Bounty |
*.kucoin.com Copy Copied | Web | Critical | Bounty |
https://www.kucoin.com/download
https://www.kucoin.com/download
Target | Type | Severity | Reward |
---|---|---|---|
zendesk Copy Copied https://support.kucoin.plus/ | Web | None | Bounty |
SandBox Copy Copied https://sandbox.kucoin.com/ | Web | None | Bounty |
KuCoin store Copy Copied https://store.kucoin.com/ | Web | None | Bounty |
Api docs Copy Copied https://docs.kucoin.com/ | Web | None | Bounty |
intro.kucoin.com Copy Copied | Web | None | Bounty |
cert.kucoin.com Copy Copied | Web | None | Bounty |
passport.kucoin.com Copy Copied | Web | None | Bounty |
SandBox Copy Copied sandbox-*.kucoin.com | Web | None | Bounty |
SandBox Copy Copied *-sdb.kucoin.com | Web | None | Bounty |
SandBox Copy Copied *-sandbox.kucoin.com | Web | None | Bounty |
https://support.kucoin.plus/
https://sandbox.kucoin.com/
https://store.kucoin.com/
https://docs.kucoin.com/
sandbox-*.kucoin.com
*-sdb.kucoin.com
*-sandbox.kucoin.com
IN-SCOPE VULNERABILITIES - WEB
We are mostly interested in the following vulnerabilities:
IN-SCOPE VULNERABILITIES - MOBILE
OUT OF SCOPE - WEB
OUT OF SCOPE - MOBILE
More Details about KuCoin's Vulnerability Bounty
Extreme(1000000$):
Vulnerabilities that is especially serious or of great influence
Critical (50000 - 100000$ + additional bounty varies ):
1. The RCE of the Staking node
2. Vulnerabilities can access to the core business of the system directly has the potential to do great harm
High Risk (2000 - 49999$):
1. Leakage of sensitive user information (greater than 15%)
2. User 2FA bypass
3. Unauthorized access, serious SQL injection
Medium risk(500 - 1999$):
1. Affect the use of some users and access, modify user information
2. Leakage of sensitive user information (3% -15%)
3. Due to the security class vulnerability caused more than 1000 users of the normal transaction
Low Risk (50-499$):
1. Text message bombs, non-sensitive information leaks, etc.
2. Server security is compromised due to a configuration leak.
3. Leakage of sensitive user information (less than 3%)
More About KuCoin threat intelligence bounty scope (For threat hunter bounty)
Critical (5000 – 10000$ additional bounty varies):
1. The intrusion intelligence of the core system can provide key information such as intrusion event traceability analysis and the attacker's identity.
2. Information that can have a significant impact on KuCoin's revenue (such as large-scale wool harvesting, serious payment risk information, etc.).
3. Threat organization activity intelligence that has an extremely significant impact on core products, and can provide threat organization traceability information.
4. Large-scale sensitive information leakage (such as user kyc credentials), provide leaked data and track the cause of the leak.
High Risk (1500 – 5000 $)
1. Intrusion intelligence of non-core systems can provide key information such as intrusion event traceability analysis and attacker identities.
2. Relevant information that has a greater direct impact on KuCoin's business revenue
3. Threat activity intelligence that can have a greater impact on KuCoin products, and can provide threat organization traceability information.
4.Medium-scale sensitive information leakage (such as user login credentials), provide leaked data and trace the cause of the leak.
Medium Risk (300 - 500 $)
1. New attack methods and technologies that can help improve the risk control system for high-risk and above-level hazards
2. Threat activity intelligence that can have a certain impact on KuCoin revenue
3. Small-scale sensitive information leakage (such as user login credentials), provide leaked data and track the cause of the leak
Low Risk ( 50$-150)
Intelligence that has only a slight impact on KuCoin's business revenue
Out of scope (0$)
1. Information that cannot be investigated and utilized based on the information provided and that does not constitute actual harm
2. Known, disclosed or invalid information
3. Individual cases, unable to provide proof of scale
In order to be deemed valid, a report must demonstrate a software vulnerability in a service provided by Kucoin that harms Kucoin or Kucoin customers. Reports that include a clear Proof of Concept or specific step by step instructions to replicate the vulnerability are considerably more effective at communicating a researcher’s findings and are therefore far more likely to be deemed valid.
A report must be a valid, in scope report in order to qualify for a bounty. Kucoin awards bounties based on severity of the vulnerability. We determine severity based on severity. For example:
In order to provide general guidelines to researchers regarding the payouts that can be expected for a given report, Kucoin uses the severity of a report to place the report into one of the following tiers.
The payouts listed next to each tier are ranges of bounties for the tier. Bonuses in excess of the tier minimum can be awarded based on the severity of the vulnerability or creativity of the exploitation. Researchers are also more likely to earn a larger reward for exceptionally clear and high-quality reports. Previous bounty amounts are not considered precedent for future bounty amounts. Software is constantly changing and therefore the given security impact of the exact same vulnerability at different times in the development timeline can have drastically different security impacts.