Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
82 of 15,219 reports · 227 analysed so far
- #3307874ValidCritical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisMonero · Denial of Service · 2026 · Critical–97votes
- #2858802Validlow-level p2p ping + tcp flooding leads to a remote crash in monerodMonero · No weakness recorded · 2025 · Critical–97votes
- #2425873Valid[Monero wallet RPC] File precreation to file ownership and credentials leakMonero · Access Control · 2024–75votes
- #3620006ValidWallet RPC Restricted-Mode Policy BypassMonero · Authentication · 2026 · High–54votes
- #3738727ValidRestricted RPC leaks alternative block hashes via /get_alt_blocks_hashesMonero · Access Control · 2026 · Low–52votes
- #2338094ValidRPC service DOSMonero · Denial of Service · 2025 · Medium–47votes
- #1981441ValidDynamic fee algorithm doesn't check for zero feeMonero · Denial of Service · 2025 · Low–46votes
- #3819475ValidMonero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient fieldMonero · No weakness recorded · 2026 · Medium–44votes
- #3693636Validwallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)Monero · Memory Corruption · 2026 · High–44votes
- #357858Validforum.getmonero.org Shell uploadMonero · Command and Code Injection · 2018–43votes
- #3699522Valid`check_reserve_proof` counts duplicate entries: one output can inflate `total`Monero · Input Validation and Logic · 2026 · Medium–42votes
- #3619409ValidWindows installer grants low-privileged users write access to executable P2Pool directory, enabling local code executionMonero · Access Control · 2026 · High · a user account (title)–40votes
- #3601469ValidRestricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin ActionsMonero · Authentication · 2026 · High · no account (title)–40votes
- #3185083ValidConnection Count Bug in Monero Node Enables Outbound Peer Reset AttackMonero · Information Disclosure · 2026–39votes
- #3698862Valid`check_reserve_proof` sums RingCT ECDH amounts without checking the output commitmentMonero · Cryptography · 2026 · Medium–37votes
- #3683934Validsign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txsetMonero · No weakness recorded · 2026 · High–35votes
- #3686283ValidView-only offline transaction creation bypasses the long-payment-ID privacy blockMonero · Information Disclosure · 2026 · Medium–32votes
- #3621588ValidAuthenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer changeMonero · Input Validation and Logic · 2026 · High–32votes
- #3679471ValidHTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund TransferMonero · Command and Code Injection · 2026 · Medium–30votes
- #3621606ValidZMQ RPC Log Injection and Untrusted Payload PersistenceMonero · Injection and Smuggling · 2026 · Medium–30votes
- #506595ValidCryptoNote: remote node DoSMonero · Denial of Service · 2019–30votes
- #265161ValidMonero Website & Kovri on your policy are returning 404 not found.Monero · Input Validation and Logic · 2018–29votes
- #3700036ValidSpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hashMonero · Cryptography · 2026 · Medium–28votes
- #1379707ValidRPC call crashes nodeMonero · Denial of Service · 2022–28votes
- #817245ValidHardware Wallets Do Not Check Unlock TImeMonero · Cryptography · 2021–27votes
- #3683886ValidRestricted ZMQ RPC bypasses HTTP restricted-mode resource checksMonero · No weakness recorded · 2026 · Medium–26votes
- #3240792ValidReported RPC OverflowMonero · Memory Corruption · 2026–25votes
- #2912194ValidRemote memory exhaustion in Epee RPC stack under zero Receive WindowMonero · Denial of Service · 2025 · High–24votes
- #876530Not checked yetRemote node DOSMonero · Denial of Service–24votes
- #3816330ValidMonero IPv6 /128 tracking bypasses per-IP limit, enables remote OOMMonero · Denial of Service · 2026 · High–23votes
- #3241102ValidReported Denial of ServiceMonero · Denial of Service · 2026–23votes
- #2693786ValidA peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.Monero · No weakness recorded · 2025–23votes
- #2315026ValidTransactions in invalid blocks are kept in tx-pool without undergoing certain checks.Monero · No weakness recorded · 2025–23votes
- #3681690ValidZMQ get_output_distribution duplicate amount DoSMonero · No weakness recorded · 2026 · Medium–22votes
- #2677306ValidSpamming highly nested JSON RPC requests cause node to disconnect from p2p networkMonero · Denial of Service · 2025–22votes
- #3719670Valid`monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactionsMonero · Information Disclosure · 2026 · Medium–21votes
- #3648638Validmonero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction modeMonero · Input Validation and Logic · 2026 · Medium–21votes
- #3687543Valid`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`Monero · Access Control · 2026 · Low–20votes
- #854726ValidUnix time unlock_time values have dangerous validation rules enabling a number of exploitsMonero · Input Validation and Logic · 2021–20votes
- #3723315Validwallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring memberMonero · Memory Corruption · 2026 · Medium–19votes
- #3547349ValidInverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different portsMonero · No weakness recorded · 2026–18votes
- #379049ValidAttcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubsMonero · Input Validation and Logic · 2018–17votes
- #825091ValidArray Index Underflow--http rpcMonero · Memory Corruption · 2021–16votes
- #713321ValidExploiting Network and Timing Side-Channels to Break Monero Receiver AnonymityMonero · No weakness recorded · 2019–16votes
- #1668258ValidReentrancy attack in eth-monero atomic swapMonero · Access Control · 2023–15votes
- #291489ValidKovri: potential buffer over-read in garlic clove handling + I2NP message creationMonero · Information Disclosure · 2017–14votes
- #340012ValidBuffer out of bound read in miniupnpc xml parserMonero · Memory Corruption · 2018–13votes
- #304770ValidCorrupt RPC responses from remote daemon nodes can lead to transaction tracingMonero · Information Disclosure · 2018–13votes
- #3515557ValidLoss of multisig funds through single malicious participant's deliberate deceptionMonero · Input Validation and Logic · 2026 · Medium–12votes
- #391611ValidMalicious get_random_rct_outs.bin rpc can cause a near-infinite loopMonero · Denial of Service · 2018–12votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.