OpenSea

Crypto/DeFi

The world's largest NFT marketplace supporting multiple blockchains for buying, selling, and discovering digital collectibles.

Max Reward

$50,000

Total Paid

$1,800,000

Resolved

198

Avg Response

3 days

opensea.io

Marketplace frontend and listing/bidding system

OpenSea API

NFT data, events, and orders API

Seaport Protocol

Smart contract marketplace protocol

OpenSea Pro

Aggregator and pro trading tools

Critical

RCE, authentication bypass, privilege escalation, fund extraction

High

Stored XSS, CSRF with impact, API abuse, data manipulation

Medium

Reflected XSS, data leakage, logic flaws, information disclosure

Low

Verbose errors, minor config issues, low-impact info disclosure

ID	Title	Severity	Status	Reward	Submissions
OS-001	NFT listing price manipulation via Seaport order signature replay	Critical	Open	$15,000–$50,000	0
OS-002	IDOR in collection stats API exposing hidden listings	Medium	Resolved	$2,000–$5,000	4

• Do not access, modify, or delete data belonging to other users.

• Do not perform denial-of-service attacks or automated scanning at high volume.

• Report vulnerabilities promptly and provide sufficient detail to reproduce.

• Allow reasonable time for fix before public disclosure (90 days).

• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.