Jupiter
The leading Solana DEX aggregator providing best-price swaps, limit orders, and DCA across all Solana DEXes.
https://jup.agMax Reward
$50,000
Total Paid
$700,000
Resolved
45
Avg Response
2 days
In-Scope Assets
jup.ag
Swap interface, limit orders, and DCA
Jupiter API
Quote, swap, and price APIs
Jupiter Perpetuals
Leveraged trading platform
Jupiter Lock
Token vesting and locking
Out of Scope
- ✕ Jupiter DAO governance
- ✕ LFG Launchpad voting
- ✕ Community content
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| JUP-001 | Quote API manipulation returning inflated swap amounts | High | Open | $5,000–$20,000 | 0 |
| JUP-002 | DCA order front-running via predictable execution timing | Medium | In Review | $2,000–$10,000 | 1 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.