Rewards

Reward Calculation

Rewards are calculated based on the CVSS v4.0 Base score of the vulnerability. The final reward amount is determined by our security team after internal assessment, taking into account Environmental metrics and business context. The figures below are maximum ranges, not entitlements — see Reward Determination.

Assessment and Payouts

• Official scoring: CVSS v4.0 (Base score). Researchers specify the Base vector in the report; the final assessment and reward amount is determined by our security team after internal recalculation of Environmental metrics (business context consideration).
• Payouts are determined by vulnerability types. If the discovered vulnerability is not listed, the payout assessment is conducted based on ranges considering the CVSS score (see table below).
• Exploits leading to financial fraud or mass PII leakage increase the payout within the specified ranges.
• No payouts for: duplicates, theoretical reports without reproducible PoC, out-of-scope reports.
• Payouts are made in USD-denominated stablecoins; taxes are the responsibility of the recipient.

Reward Determination

A valid report establishes eligibility for consideration. It does not establish a right to a payment or to a particular amount. Bron determines the final severity and the final reward, including a decision to issue no monetary reward.

Severity is assigned by Bron

• The CVSS vector supplied in a report is a claim, not a rating. Bron recalculates severity from the impact actually demonstrated against a production target, applying Environmental metrics and business context.
• Severity follows demonstrated impact, not vulnerability class. Membership of a class listed on a scope page does not assign a severity or a reward tier.
• For a chain of steps, severity is taken from the weakest demonstrated link — not from the most severe outcome the chain would reach if the remaining steps were also demonstrated.

Recognised without a monetary reward

The following are accepted as valid contributions and are normally acknowledged in the Hall of Fame without a payment:

• Low severity. Low-severity findings are recognised rather than paid, unless Bron decides otherwise in a particular case.
• Accepted risk. Behaviour that Bron confirms but considers to be within its threat model or a deliberate product decision — whether or not it is later changed.
• No demonstrated impact. Absence of a hardening control, deviation from best practice, or a defect whose exploitation is not demonstrated against a production target.
• Library-level findings with no reachable caller. A defect in code that no production path invokes under the conditions the defect requires.

No reward

• Duplicates and variants. One reward per underlying defect. The same root cause reported at a different call site, screen, route, endpoint or network is a duplicate, including where the earlier report came from another researcher.
• Already known. Issues already identified by Bron, by a prior audit, or by Bron's own tooling before the report was received.
• Out of scope. Targets, environments and impact classes excluded by this policy or by the relevant scope page, including testnet and other non-production deployments.
• No reproducible proof of concept. Theoretical reports, automated scanner output without manual verification, and reports Bron cannot reproduce.
• Policy breach. Testing involving third-party accounts or data, prohibited testing methods, or disclosure before a written agreement is reached.

A remediation is not an admission

Bron may change a product, a configuration or a programme page after receiving a report, for reasons of its own. Such a change does not establish that the report was eligible for a reward, does not set its severity, and does not create an obligation to pay. Equally, a decision to change nothing does not invalidate a report that qualifies on its merits.

Who Gets the Bounty

• The reward goes to the first valid report with sufficient PoC (recorded in our logs: timestamp of incoming email/form + raw e-mail + PoC hashes + auto-response record).
• If two independent reports are received within 48 hours and both contain different, reproducible PoCs, the committee may decide on an equal 50/50 split.
• When refining an already confirmed report — for example, providing an improved PoC, refined exploitation vector, or more detailed impact analysis — the researcher may receive additional compensation at the committee's discretion.

Testing Scope & Reward Applicability

For category-specific reward ranges, impact definitions, and testing requirements, see the dedicated pages:

• Web Applications & APIs
• Mobile Applications
• Desktop Applications
• Smart Contracts
• MPC Cryptography Library