A4 Bug Bounty

We are constantly working to ensure a decent level of security for our products and our users' data. We hope you can help us with this. Below are the rules of our bug bounty program. Please read them carefully.

Vulnerability Category and Rewards

Each participant who is the first to find and report a valid vulnerability can receive a monetary reward. The amount of the reward depends on the criticality of the found vulnerability. Our experts will assess the vulnerability and, based on the analysis, determine the criticality, based on the damage that could result from it.

Critical	100000 A4	Local
High	30000 A4	For Publicly Accessible Asset
Medium	10000 A4	Token Leakage via Host Header Poisoning
Low	3000 A4	Non-Privileged User to Anyone

Send your findings to “[email protected]”. Also please encrypt the content of your emails with this GPG key.
In your email, provide all the information you need about the error found:

Vulnerability Category
Resume
Description
Actions to reproduce or proof of concept
Any relevant tools, including versions used
Tool logs
Possible options for fixing from your point of view

Report a bug

Bounty Program rules

All error and bug reports should be submitted from the form on the website
All bug reports are rated by A4 team and paid based on the severity of the vulnerability.
To receive payment for errors and bugs, you need to have an A4 account and link the email address you used to report bugs. Don't forget to report the UID of your A4 account. Rewards will be received in USDT and distributed to the account you specified.
A request for a payout in exchange for information about a vulnerability will result in the immediate disqualification from the reward program.
Please provide as much detail as possible so that we can reproduce your findings. Otherwise, you may miss out on rewards.
For combined vulnerabilities that can be exploited, we only pay for the highest level of vulnerabilities. For the same vulnerabilities, we will only pay for the first one, which contains enough detail in the report.
A4 reserves the right to cancel or change the bug bounty rules at its sole discretion.

Exceptions to the Program

We do not consider or accept as vulnerabilities:

Messages from security scanners and other automatic scanning tools.
Messages without demonstrating the actual existence of the vulnerability.
Messages without indicating reliably possible negative consequences.
Messages about missing security headers.
Attacks that require MITM or physical access to the user's device.
Vulnerabilities that only affect users of legacy or vulnerable browsers and platforms.
Vulnerabilities that can only hurt yourself.
Vulnerabilities we already know about.

Vulnerability categories

Critical vulnerability

Access to multiple devices on the internal network.
Obtaining superuser access to the main server part, leaking the main data of the enterprise and causing serious damage.
Smart contract overflow and conditional competition vulnerability.

High vulnerability

Gaining access to the system (getting a shell, executing commands, etc.).
Injecting system SQL (reducing backend vulnerabilities, prioritizing sending packets as needed).
Get unauthorized access to sensitive information, including but not limited to direct access to the management background by bypassing authentication, cracking backend passwords, SSRF getting sensitive information on the internal network, etc.
Random reading of the document.
XXE is a vulnerability that can access any information.
Unauthorized transaction involves money, payment logic bypass (must be used successfully).
Serious logical design defects and technological defects. This includes, but is not limited to, any user login vulnerability, account password batch change vulnerability, logical vulnerability affecting the core business of an enterprise, etc., except for the verification code explosion.
Other vulnerabilities affecting users on a large scale. This includes, but is not limited to, XSS storage which can automatically propagate to critical pages. The XSS store can access the admin authentication information and can be used successfully.
Lots of source code leaked.
Enable defect control in a smart contract.

Medium vulnerability

A vulnerability that could affect users through interaction. It includes but is not limited to storage XSS on shared pages, core business related CSRF, etc.
General unauthorized work. It includes, but is not limited to, modifying user data and performing user operations bypassing restrictions.
Denial of service vulnerabilities. It includes, but is not limited to, remote denial of service vulnerabilities caused by web application denial of service.
Vulnerabilities caused by a successful explosion with a system-sensitive operation such as access to the account credentials due to logical flaws in the verification code.
Leakage of locally stored confidential authentication key information that needs to be used effectively.

Low vulnerability

Local denial of service vulnerabilities. It includes but is not limited to local client denial of service (parsing file formats, crashes generated by network protocols), issues caused by Android component permissions being exposed, application sharing, etc.
Leakage of general information. This includes but is not limited to web path traversal, system path traversal, directory browsing, etc.
Reflective XSS type (including DOM XSS / Flash XSS).
Generic CSRF.
URL Skip Vulnerability.
SMS bombs, mail bombs (each system accepts only one type of this vulnerability).
It is impossible to prove that other less dangerous vulnerabilities are dangerous (for example, a CORS vulnerability that cannot access sensitive information).
No return value and no deep use of successful SSRF.