Bron never holds or controls user private keys, funds, or assets. All transactions are user-initiated and executed directly with third-party smart-contract protocols. Swap and staking functions are performed via independent third-party APIs. Bron only provides technical access and does not pool, intermediate, or custody user assets.
Reward Calculation
Rewards are calculated based on the CVSS v4.0 Base score. Use the official calculator: https://www.first.org/cvss/calculator/4-0
Every accepted bounty submission entitles the researcher to a non-transferable Bron NFT in addition to the monetary reward listed below. The NFT grants a complimentary Basic tier subscription for 2026 (or an upgrade to the next tier if Basic is already active, capped at Enterprise). To receive any reward, a Bron wallet is required — bounty payments are distributed in stablecoins to the researcher's Bron wallet address.
| Severity Level | CVSS v4.0 Score | Reward Range (USD) |
|---|---|---|
| Low | 0.1 — 3.9 | $50 — $250 |
| Medium | 4.0 — 6.9 | $250 — $2,500 |
| High | 7.0 — 8.9 | $2,500 — $5,000 |
| Critical | 9.0 — 9.4 | $5,000 — $10,000 |
| Exceptional | 9.5 — 10.0 | more than $10,000 |
If the PoC demonstrates direct financial impact, mass PII leakage, or full account takeover with access to funds, our security team may apply an increased reward within the specified ranges.
All bounty payments will be made in USD-denominated stablecoins to the researcher's Bron wallet address and are subject to sanctions screening and anti-money-laundering controls consistent with Bron's compliance policy. Rewards cannot be paid to individuals or entities on applicable sanctions lists.
Scope
The following mobile applications are in scope:
- Android: Official Bron Wallet for Android on Google Play (package
org.bron.mobile) - iOS: Official Bron Wallet for iOS on the App Store (requires iOS 16.4+)
Only the official latest published Store build is in scope. Development, beta, and TestFlight builds are excluded.
Impacts in Scope
The following vulnerability classes are in scope for the Mobile program:
Critical / High Priority
- IDOR / Authorization via API: Insecure direct object reference or authorization bypass reachable from the mobile API
- Auth / Session Flaws: Token leak, token reuse, or session hijacking without physical access
- Insecure Local Storage of Secrets: MPC key shares, private key material, or session tokens stored unprotected in SQLite, SharedPreferences, NSUserDefaults, or application logs
- Exported Android Components: Activities, services, receivers, or providers exported without appropriate permission checks
- Deep-Link Hijacking: Deep-link handling that allows auth/session bypass or fund-related actions without user consent
- WebView JS-Bridge Attacks: Exploiting
addJavascriptInterface, attacker-controlled URL loads, or missing origin validation in the embedded WebView - Clipboard Exposure of Secrets: MPC key shares, private key material, or session tokens copied to the clipboard on a non-rooted device
- Missing FLAG_SECURE: Absence of
FLAG_SECUREon key-material, signing, or recovery screens - Transaction-Signing UI Manipulation: Address or amount spoofing in the transaction confirmation UI
- Biometric Bypass with Fund / Key Access: Bypassing biometric authentication in a way that grants access to funds, private keys, or signing capability
- Server-Side Vulnerabilities via Mobile API: Backend vulnerabilities reachable through the mobile application's API endpoints
Out of Scope — Mobile Application Specific
For general exclusions applicable to all testing scopes, see the Policy page. The following are Mobile-specific exclusions:
Mobile-Specific Exclusions
- Rooted / jailbroken device: Issues exploitable only on a rooted or jailbroken device.
- Runtime instrumentation: Findings relying on Frida, Objection, Xposed, or any hooking or instrumentation framework.
- Emulator-only: Vulnerabilities not reproducible on a real physical device.
- Modified / repackaged app: Attacks requiring a modified or repackaged build of the application.
- Debug / development builds: Issues present only in non-production debuggable builds.
- Certificate pinning, root / jailbreak detection, or tamper detection absent — alone: Absence of these controls without a demonstrated exploitable impact.
- Physical access to an unlocked device: Attacks requiring physical access to an unlocked device; MITM on an attacker-controlled network without bypassing pinning.
- Reverse engineering / hardcoded non-secret strings: Without demonstrated exploitable impact.
- Biometric bypass alone: Biometric bypass without access to funds, private keys, or session elevation.
- Crashes / DoS without security impact: Application crashes or denial-of-service without a demonstrated security consequence; automated scanner output without manual verification.
- Outdated OS / devices: Not reproducible on the current OS or devices released within the last 2 years.