Polygon
Leading Ethereum scaling solution providing fast and low-cost transactions through PoS, zkEVM, and CDK technology.
https://polygon.technologyMax Reward
$100,000
Total Paid
$1,800,000
Resolved
123
Avg Response
4 days
In-Scope Assets
Portal
Bridge, staking, and wallet interface
Polygon zkEVM
Zero-knowledge EVM rollup contracts
Polygon PoS
Proof-of-stake chain validators and checkpoints
Polygon CDK
Chain Development Kit and components
Out of Scope
- ✕ Polygon ID (separate program)
- ✕ Third-party dApps
- ✕ Community forums
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| MATIC-001 | Bridge fund extraction via crafted merkle proof | Critical | Open | $50,000–$100,000 | 0 |
| MATIC-002 | zkEVM state transition verification bypass | Critical | In Review | $50,000–$100,000 | 1 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.