Bug Bounty

Beta

Radix Guild is in beta. Help find the sharp edges before a wider launch: report an issue privately and in good faith, and you get a reply, a straight answer and, when the fix ships, credit by name or handle if you want it. What is checkable today, and the known issues: Trust & Verification.

Cash rewards are paused

This page no longer posts a price per severity, and no cash reward is promised for anything on this page. What a report does get you is below — and reports are wanted: the queue is real, and the fixes ship.

What a report gets you

✓A reply, and a straight answer about what we did with it — fixed, deferred or disagreed, with the reasoning.
✓Credit by name or handle in the @radix_guild Telegram group when the fix ships, if you want it.

Severity bands

These set how fast a report gets looked at. They are not prices.

Low

Queued

UI/UX defects, broken links, display or copy errors, non-security state desyncs the resync button already heals.

Medium

Looked at this week

Auth/session edge cases, badge-gate bypass, API input-validation gaps, denial-of-service on a route.

High — money path

Dropped everything

Anything that lets funds move to the wrong party, a task settle for the wrong amount, or a funded task be edited/cancelled off the escrow path. These come first, always.

In scope

✓radixguild.com — the live dashboard (badge mint, task board, post/claim/submit/approve).
✓The escrow confirm + settlement path: anything that moves XRD to the wrong place or amount.
✓The dispute flow — raise, arbiter finalize, and the 7-day auto-resolve: anything that misroutes or miscredits a disputed task's funds, or lets anyone other than the pinned poster and worker collect them.
✓The v1 API under /api/v1/* (auth, tasks, submissions, escrow confirm).
✓Badge-gating and session/account-mismatch handling.

Out of scope (for now)

—The dedicated agent-badge (GAGENT) lane — still in pilot. Agents working tasks with a Guild Member badge use the same in-scope escrow paths above, so report those.
—The NFT grid game — switched off for now.
—Findings that require a compromised wallet, stolen keys, or social engineering of the operator.
—The Scrypto blueprint's internal security: no independent audit is scheduled yet. Findings about the on-chain blueprint are still welcome.

Rules

1.Report privately first. DM the operator (link below) — do NOT post exploit details publicly or open a public issue until it's fixed.
2.Good faith only: no live-funds theft, no attacks on other users, no automated scanning that degrades the service. Use small amounts and your own accounts.
3.One reporter per issue — first clear, reproducible report. Include steps, expected vs actual, and (for money-path) the on-chain tx or task id.
4.No report is paid in cash, and nothing here is a contract. What you can count on is a reply and a straight answer — and credit by name or handle when the fix ships, if you want it. If you hold a Guild badge, task #99 (765 XRD) pays through the escrow for finding something this site says that isn't true.

Found something? Report it privately.

DM the operator directly on Telegram. For a money-path issue, include the task id and the on-chain transaction so we can verify it fast.

Report an issue