Bron never holds or controls user private keys, funds, or assets. All transactions are user-initiated and executed directly with third-party smart-contract protocols. Swap and staking functions are performed via independent third-party APIs. Bron only provides technical access and does not pool, intermediate, or custody user assets.
Reward Calculation
Rewards are calculated based on the CVSS v4.0 Base score. Use the official calculator: https://www.first.org/cvss/calculator/4-0
Every accepted bounty submission entitles the researcher to a non-transferable Bron NFT in addition to the monetary reward listed below. The NFT grants a complimentary Basic tier subscription for 2026 (or an upgrade to the next tier if Basic is already active, capped at Enterprise). To receive any reward, a Bron wallet is required — bounty payments are distributed in stablecoins to the researcher's Bron wallet address.
| Severity Level | CVSS v4.0 Score | Reward Range (USD) |
|---|---|---|
| Low | 0.1 — 3.9 | Up to $250 |
| Medium | 4.0 — 6.9 | $250 — $2,500 |
| High | 7.0 — 8.9 | $2,500 — $5,000 |
| Critical | 9.0 — 9.4 | $5,000 — $10,000 |
| Exceptional | 9.5 — 10.0 | more than $10,000 |
If the PoC demonstrates direct financial impact, mass PII leakage, or full account takeover with access to funds, our security team may apply an increased reward within the specified ranges.
All bounty payments will be made in USD-denominated stablecoins to the researcher's Bron wallet address and are subject to sanctions screening and anti-money-laundering controls consistent with Bron's compliance policy. Rewards cannot be paid to individuals or entities on applicable sanctions lists.
Scope
The following mobile applications are in scope:
- Android: Official Bron Wallet for Android on Google Play (package
org.bron.mobile) - iOS: Official Bron Wallet for iOS on the App Store (requires iOS 16.4+)
Only the official latest published Store build is in scope. Development, beta, and TestFlight builds are excluded.
Impacts in Scope
The following vulnerability classes are in scope for the Mobile program. Severity is assigned by demonstrated impact, not by class membership — a report qualifies only when it demonstrates the stated impact on the official Store build. The absence of a hardening control, on its own and without a demonstrated consequence, is not a finding.
Critical
- Key Material Exposure: Extraction of MPC key shares or private key material from device storage, memory, backups, or any other channel
- Transaction-Signing UI Manipulation: The address, amount, or asset shown in the confirmation UI differs from what is actually signed
- IDOR / Authorization via API: Insecure direct object reference or authorization bypass reachable from the mobile API, demonstrated to read or modify another user's or another workspace's data
- Auth / Session Flaws: Token leak, token reuse, or session hijacking without physical access, demonstrated to grant access to another user's account
- Deep-Link Hijacking: Deep-link handling that achieves authentication or session bypass, or a fund-related action, without user consent
- WebView JS-Bridge Attacks:
addJavascriptInterface, attacker-controlled URL loads, or missing origin validation, demonstrated to reach native capability, session material, or signing
High
- Insecure Local Storage of Secrets: Session tokens or other reusable credentials recoverable from SQLite, SharedPreferences, NSUserDefaults, backups, or application logs on a non-rooted device
- Biometric Bypass with Fund / Key Access: Bypassing biometric authentication in a way that grants access to funds, private keys, or signing capability
- Exported Android Components: Activities, services, receivers, or providers exported without appropriate permission checks, with a demonstrated invocation from a third-party application that reaches a sensitive action
- Clipboard Exposure of Secrets: Reusable credentials or key material placed on the clipboard by the application itself on a non-rooted device
- Server-Side Vulnerabilities via Mobile API: Backend vulnerabilities reachable through the mobile application's API, rated by the impact of the underlying issue under the Web & API program
Medium
- Sensitive Data Exposure: Another user's data, or a reusable credential, written to application logs, crash reports, or unencrypted backups
- Session Management Issues: Session fixation, missing invalidation on logout, or a session that survives device unlink
Low
- Minor Information Disclosure: Non-sensitive leaks such as build metadata, API structure, or diagnostic data
Out of Scope — Mobile Application Specific
For general exclusions applicable to all testing scopes, see the Policy page. The following are Mobile-specific exclusions:
Mobile-Specific Exclusions
- Rooted / jailbroken device: Issues exploitable only on a rooted or jailbroken device.
- Runtime instrumentation: Findings relying on Frida, Objection, Xposed, or any hooking or instrumentation framework.
- Emulator-only: Vulnerabilities not reproducible on a real physical device.
- Modified / repackaged app: Attacks requiring a modified or repackaged build of the application.
- Debug / development builds: Issues present only in non-production debuggable builds.
- Certificate pinning, root / jailbreak detection, or tamper detection absent — alone: Absence of these controls without a demonstrated exploitable impact.
- Physical access to an unlocked device: Attacks requiring physical access to an unlocked device; MITM on an attacker-controlled network without bypassing pinning.
- Reverse engineering / hardcoded non-secret strings: Without demonstrated exploitable impact.
- Screen-capture protection (
FLAG_SECURE) — alone: Absence ofFLAG_SECURE, or of screenshot and screen-recording protection, on any screen. Bron is an MPC product: there is no seed phrase, and no private key or key share is rendered on any screen. Screenshots, screen recording and screen sharing are initiated by the owner of the device against their own display, and capture of a displayed second factor does not by itself grant account access or the ability to move funds. In scope only where the captured content alone is sufficient to access an account or move funds. - Biometric bypass alone: Biometric bypass without access to funds, private keys, or session elevation.
- Crashes / DoS without security impact: Application crashes or denial-of-service without a demonstrated security consequence; automated scanner output without manual verification.
- Outdated OS / devices: Not reproducible on the current OS or devices released within the last 2 years.
- Signature / contract clear-signing gaps: Missing or incomplete decoding of off-chain typed-data signatures or contract interactions (EIP-712, EIP-3009, EIP-2612, Permit2, Seaport) shown as a raw payload without a human-readable effect or risk warning. Requires the user to connect a malicious dApp and approve a signature; a signature alone does not move funds. See general exclusions.