Bug bounty program · HackerOne
Most upvoted reports82
- #2858802Validlow-level p2p ping + tcp flooding leads to a remote crash in monerodMonero · No weakness recorded · 2025 · Critical–97votes
- #3307874ValidCritical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisMonero · Denial of Service · 2026 · Critical–97votes
- #2425873Valid[Monero wallet RPC] File precreation to file ownership and credentials leakMonero · Access Control · 2024–75votes
- #3620006ValidWallet RPC Restricted-Mode Policy BypassMonero · Authentication · 2026 · High–54votes
- #3738727ValidRestricted RPC leaks alternative block hashes via /get_alt_blocks_hashesMonero · Access Control · 2026 · Low–52votes
- #2338094ValidRPC service DOSMonero · Denial of Service · 2025 · Medium–47votes
- #1981441ValidDynamic fee algorithm doesn't check for zero feeMonero · Denial of Service · 2025 · Low–46votes
- #3693636Validwallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)Monero · Memory Corruption · 2026 · High–44votes
- #3819475ValidMonero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient fieldMonero · No weakness recorded · 2026 · Medium–44votes
- #357858Validforum.getmonero.org Shell uploadMonero · Command and Code Injection · 2018–43votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.