Coindcx - Bug Bounty Program

About

Coindcx

CoinDCX is India’s largest and safest cryptocurrency exchange. Our exchange is built with user experience and security in mind. The KYC and Bank Account verification are done within a few minutes and give users a smooth onboarding experience. We provide users single-point access to a diverse suite of crypto-based financial products and services that are backed by security processes and insurance.

Program Rules

Testing Policy and Responsible Disclosure

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on Coindcx applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
• Do not copy any files from our applications/servers and disclose them.
• No vulnerability disclosure, full, partial or otherwise, is allowed.
• Please avoid spamming support requests.

Reward Eligibility

We are happy to thank everyone who submits valid reports which help us improve the security of Coindcx, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and Coindcx, and remediation advice on fixing the vulnerability
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
• You must not break any of the testing policy rules listed above
• You must not be a former or current employee of Coindcx or one of its contractors.

Reward amounts are based on:

• Reward grid of the report's scope
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis

Complements about our scopes

Here is our main scope:

• https://coindcx.com/ - Main Webapp
• https://api.coindcx.com - API used by our web application & Mobile applications
• CoinDCX: Crypto Investment
• CoinDCX: Bitcoin & Crypto Investment app - Android
• CoinDCX:Trade Bitcoin & Crypto - iOS

We are particularly interested in the below vulnerabilities:

• Web3 related Security Issues
• Accessing other user’s accounts or financial information
• Accessing the wallets of other users
• Authentication & Authorization
• Withdrawing funds as a sub account
• SSL Pinning Bypass, Root detection and other security features