Jupiter (jup.ag) Bug Bounty: Earn Up to $5,000 for Critical Vulnerabilities

Jupiter is the most-used decentralized exchange (DEX) aggregator on Solana, routing billions of dollars in monthly swap volume across dozens of liquidity sources. With that scale comes responsibility — and Jupiter's team has reaffirmed its commitment to security by running an active bug bounty program through jup.ag/security.

Researchers who responsibly disclose critical vulnerabilities can earn up to $5,000 USDC per accepted report, paid out directly on-chain. Lower-severity findings are still rewarded along a tiered scale, and the team aims to triage all submissions within roughly 24 hours.

Bounties scale with impact, not effort. The Jupiter team uses a modified Immunefi severity classification to grade each accepted finding.

• Findings on testnet, devnet, or staging environments
• Theoretical issues without a working proof-of-concept
• Vulnerabilities in third-party integrations not maintained by Jupiter
• Spam, social-engineering, or phishing of Jupiter team members
• Any active exploitation of mainnet contracts (use a fork instead)
• Self-XSS, clickjacking on non-sensitive pages, missing CSP headers without impact
• Automated scanner output without manual validation

1. Test responsibly. Use your own wallets and test funds. Never touch other users' assets.
2. No mainnet exploitation. Reproduce findings on a local validator or mainnet fork. Demonstrating impact ≠ profiting from it.
3. Report privately. Submit through the official channel below — never in a public GitHub issue, Discord, or Twitter post.
4. Allow time to fix. Coordinated disclosure window is 90 days, extendable by mutual agreement.
5. One report, one bounty. Duplicates are paid to the first valid submission only.

Send your encrypted report to security@jup.ag using the team's public PGP key, or open a private advisory on the official GitHub jup-ag/security. Include the following:

# Title
[Critical] Brief, descriptive title of the bug

# Severity
Critical | High | Medium | Low

# Affected component
e.g. jupiter-aggregator-program @ commit abc1234

# Summary
2-3 sentences describing the issue and its impact.

# Steps to reproduce
1. Spin up a local validator: `solana-test-validator`
2. Deploy program from branch `repro/issue-XYZ`
3. Run `cargo test --test exploit -- --nocapture`

# Proof of concept
Link to a private gist, repo, or attached zip.

# Impact
Direct loss of user funds, ~$X at current TVL.

# Suggested mitigation
e.g. Add `#[account(constraint = ...)]` check on `vault` account.

# Disclosure
I agree to the 90-day coordinated disclosure policy.

Here's a sketch of what an unauthorized authority finding might look like. This is illustrative only — do not run against mainnet.

// PoC: missing authority check on `withdraw_fees`
use anchor_lang::prelude::*;

#[program]
pub mod vulnerable_program {
    use super::*;

    pub fn withdraw_fees(ctx: Context<WithdrawFees>) -> Result<()> {
        // BUG: no `has_one = authority` constraint below — anyone can call.
        let vault = &ctx.accounts.vault;
        let recipient = &ctx.accounts.recipient;

        **recipient.try_borrow_mut_lamports()? += vault.to_account_info().lamports();
        **vault.to_account_info().try_borrow_mut_lamports()? = 0;
        Ok(())
    }
}

#[derive(Accounts)]
pub struct WithdrawFees<'info> {
    #[account(mut)]
    pub vault: Account<'info, Vault>,
    #[account(mut)]
    pub recipient: Signer<'info>,
    // FIX: add `pub authority: Signer<'info>,` and `has_one = authority` above.
}