Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Misreporting of received amount by show_transfers#364904	Valid	Input Validation and Logic	High	2018-08-02	–	4
A bug in the Monero wallet balance can enable theft from exchanges#377592	Valid	Input Validation and Logic	Critical	2018-08-02	–	5
RingCT malformed tx prevents target from being able to sweep balance#506496	Valid	Input Validation and Logic	Medium	2019-04-20	–	9
Loss of multisig funds through single malicious participant's deliberate deception#3515557	Valid	Input Validation and Logic	Medium	2026-08-20	–	12
Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubs#379049	Valid	Input Validation and Logic	High	2018-07-27	–	17
Unix time unlock_time values have dangerous validation rules enabling a number of exploitsAnalysed#854726	Valid	Input Validation and Logic	High	2021-09-12	–	20
monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction modeAnalysed#3648638	Valid	Input Validation and Logic	Medium	2026-08-20	–	21
Monero Website & Kovri on your policy are returning 404 not found.Analysed#265161	Valid	Input Validation and Logic	None	2018-04-25	–	29
Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer changeAnalysed#3621588	Valid	Input Validation and Logic	High	2026-09-16	–	32
`check_reserve_proof` counts duplicate entries: one output can inflate `total`Analysed#3699522	Valid	Input Validation and Logic	Medium	2026-08-05	–	42

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.