Bitkub values the importance of security researchers’ efforts in helping to ensure the safety of our environment. We aim to be the most trusted platform in the digital asset industry. The aim of this program is to more effectively engage with our community and supporters in reporting any bugs and vulnerabilities (“Bug Bounty Program”).

The Bug Bounty Program scope covers all software vulnerabilities in services provided by Bitkub.

A valid report should clearly demonstrate a software vulnerability that harms Bitkub systems or customers. A report must be valid in our bounty program scope in order to qualify for a bounty. Bitkub will determine in its sole discretion whether a report is eligible for a reward and the amount of the award.

PROGRAM POLICIES

Bitkub will not take any legal action against security researchers who report a vulnerability as long as they comply with the bug bounty rules.

Please receive permission from our Security team (email us at security@bitkub.com) before engaging in conduct that may be inconsistent with or unaddressed by this policy. This report should include a brief description of your intended conduct so that we may determine whether it is consistent with the Bug Bounty Program policy.

RESEARCHER REQUIREMENTS

Be the first one to report a specific vulnerability. A duplicate report is not eligible for bounty reward.
Include details and verifiable proof of concept (e.g. screenshot, video, script). If our team cannot reproduce or verify an issue, a bounty cannot be awarded.
The reporter is eligible for bounty after Bitkub team decides to fix the bug.
Do not share the vulnerability information to any party outside Bitkub without permission.
Reporter of vulnerability is required to use their own accounts when performing testing, DO NOT attempt to view or tamper any data belonging to others.
Reporter of vulnerability is prohibited to disturb, change, add, or delete any data or configuration inside Bitkub systems, targeting other users or compromising the reputation of Bitkub.
Reporter of vulnerability is prohibited to take advantage of any vulnerability as a pivot or chain to find another vulnerability inside Bitkub systems.
DO NOT perform DDoS or DoS attacks on Bitkub systems.
By participating in this program, you have agreed to comply with all applicable laws.

DOMAINS IN SCOPE: bitkub.com

Qualifying Vulnerabilities

Business logic flaws

Trading abuse for financial gain
Coupon code/gift voucher abuse
Parameter manipulation
PII or sensitive customer data exposure
Time-of-Check-Time-of-Use (TOCTOU) and race condition
Insecure Direct Object Reference (IDOR)
Any other business logic flaw that has a clear security impact

Generic web security flaws

Injection (SQL, NoSQL, XML, etc.)
Cross-site Scripting (XSS)
Cross-site Request Forgery (CSRF)
Server-side Request Forgery (SSRF)
Local file disclosure
Remote code execution
Security misconfiguration
Cache poisoning
Any other generic web security flaw that has a clear security impact

Mobile app client-side vulnerabilities

Insecure deep links
Insecure IPCs
Any other mobile app client-side vulnerability that has a clear security impact with minimal user interaction

Web app client-side vulnerabilities such as XSS must be exploitable in the latest version of the major internet browser.

Mobile app client-side vulnerabilities such as insecure deep links must be exploitable in the latest version of Bitkub mobile app. Please note that not all insecure deep links/IPCs are eligible for a bounty.

In general, client-side vulnerabilities can be eligible for a bounty if the likelihood is high and does not require complex user interactions.

Vulnerabilities that require users to visit certain URLs or install certain applications will not have severity higher than Medium (P3).

Non-Qualifying Vulnerabilities (Out of Scope)

Exposed API keys without a clear demonstration of security impact
Issues that require non-simple user interactions such as Self-XSS and Scheme/IPC abuses that require victims to install certain applications and interacts with them - Take clickjacking as an example.
Issues that require MITM or access to a physical device
Rate limit issue other than user login and 2FA / OTP verification
Denial of service or resource exhaustion
Vulnerabilities in a vendor we integrate with (e.g Google or any provider)
Bitkub's email configuration and DNS (SPF, DMARC, DKIM)
Search engine index issues related to old e-tickets or assets that are not controlled by Bitkub
Social engineering attempts on our staff including phishing emails
Missing best practices such as HTTP security headers, SSL/TLS configuration, password and account recovery policies, cross-domain referrer leakage, invalidating active sessions, storing customer data in cookies and web storage, using authorization code in the link, and cache control issues

REPORTING THE VULNERABILITIES

All vulnerabilities should be reported to security@bitkub.com. In order to be deemed valid, a report must demonstrate a software vulnerability in a service provided by Bitkub that harms Bitkub or our customers. Reports that include a clear proof of concept or specific step by step instructions to replicate the vulnerability are considerably more effective at communicating a researcher’s findings, and therefore are more likely to be deemed valid.

REPORTS EVALUATION

Bitkub awards bounties based on CVSS v3.1 overall score of the vulnerability. In order to provide general guidelines to researchers regarding the payouts that can be expected for a given report, Bitkub provides the below table which is based on the historical payouts:

Overall Score	Level of Severity	Reward
9.0-10.0	Critical	50,000 Baht
7.0-8.9	High	10,000 Baht
4.0-6.9	Medium	3,000 Baht
0.1-3.9	Low	500 Baht

The payouts listed above are minimum bounties per category. Bonuses in excess of the vulnerability category minimum can be awarded based on the severity of the vulnerability or creativity of the exploitation. Researchers are also more likely to earn a larger reward for exceptionally clear and high-quality reports.

Previous bounty amounts are not considered a precedent for future bounty amounts. Software is constantly changing, and therefore the given security impact of the exact same vulnerability at different times in the development timeline can have drastically different security impacts.

HOW YOU CAN CONTACT US ABOUT BUG BOUNTY QUESTIONS

If you have questions or concerns regarding this program, you may find our contacts on our support page or by contacting directly our Security Officer at security@bitkub.com.

Bitkub reserves the right at its sole discretion to cancel or modify this program at any time without prior announcement.

บริการของเรา

เกี่ยวกับบิทคับ

ศูนย์ดูแลลูกค้า

ประกาศและข่าวสาร

ติดต่อเรา