Docs

Bug Bounty Program

Report security vulnerabilities in Merkl and get rewarded for responsible disclosure

Security is central to Merkl — see Security at Merkl for an overview of our security practices. Merkl rewards security researchers who find and report vulnerabilities responsibly, with rewards of up to $100,000. This page describes the scope of the program, the severity levels, the submission requirements, and the rules.

Scope

In scope

  • Merkl App — app.merkl.xyz
  • Merkl Studio — studio.merkl.xyz
  • Merkl API — api.merkl.xyz
  • Merkl smart contracts — the audited, deployed contracts (DistributionCreator, Distributor)
  • Merkl reward computation — errors in the Merkl engine that cause incorrect reward distributions

Out of scope

  • Vulnerabilities in third-party protocols incentivized through Merkl
  • Vulnerabilities in third-party vendors used by Merkl
  • Attacks on the underlying blockchains (L1/L2 infrastructure)
  • Attacks that require leaked keys, credentials, or privileged access
  • Denial-of-service (DoS/DDoS) attacks, spam, or rate-limit testing against production services
  • Social engineering, phishing, or physical attacks against Merkl team members or users
  • Issues already reported by another researcher, already known to the team, or identified in a prior audit
  • Non-production, experimental, or unaudited code
  • Best-practice findings without a demonstrated security impact (missing headers, SPF/DMARC records, clickjacking on static pages, etc.)

Severity levels

Rewards depend on severity, impact, and report quality, up to $100,000 for critical vulnerabilities. Merkl assesses each report case by case, using the following classification:

SeverityDefinition
CriticalTheft or permanent freezing of user rewards or funds, manipulation of reward distributions at scale, or full compromise of Merkl infrastructure
HighImpact on individual users: unauthorized claim of another user's rewards, significant data exposure, or account-level compromise
MediumGriefing or disruption without direct loss of funds, incorrect data with financial implications, or bypass of campaign restrictions (blacklists, whitelists)
LowLimited-impact issues and deviations from security best practices with a plausible attack path

Higher severity and a clear, reproducible report lead to a higher reward.

How to submit a report

Send your report by email to [email protected]. You can write in English or French.

To encrypt sensitive reports, use age with the SSH public key published at github.com/leomerkl.keys:

curl -s https://github.com/leomerkl.keys -o merkl.keys
age -R merkl.keys -o report.age report.txt

Then attach report.age to your email.

A good report contains:

  • Title and category — a short summary and the type of vulnerability
  • Description — a detailed explanation, with your severity assessment
  • Reproduction steps — precise step-by-step instructions
  • Proof of Concept — code, transaction, or capture that demonstrates the vulnerability
  • Impact — who is affected and what an attacker can achieve
  • Payout address — an address you control, for the reward

Merkl acknowledges valid reports and keeps you informed of the remediation progress.

Machine-readable contact information is always available at app.merkl.xyz/.well-known/security.txt.

Rules

  • Report a vulnerability as soon as you find it. Do not exploit it beyond what a Proof of Concept requires.
  • Do not access, modify, or destroy data that does not belong to you. Use your own test accounts and funds.
  • Do not disclose the vulnerability publicly before Merkl confirms that a fix is deployed.
  • Only the first researcher to report a given vulnerability is eligible for a reward.
  • Automated scanner output without a validated, exploitable finding is not eligible.
  • Merkl team members, contractors, and their close relatives are not eligible.
  • Act in good faith. Merkl does not pursue legal action against researchers who follow these rules.

Contact

PreviousSecurity at Merkl