SynergyX Bug Bounty Program
$10,000 USD. One Condition: Actually Break Something.
We built SynergyX with Kyber-768, SPHINCS+, AES-256-GCM, TLS 1.3 cert pinning, multi-pass memory wiping, anti-debugger tripwires, and layers of obfuscation that will make your decompiler cry. We're not worried. But we're also not arrogant enough to think perfection exists — so here's your invitation.
The Offer
$10,000 USD — paid in USDC, or your crypto of choice if we support it — to anyone who can demonstrate a verifiable, reproducible, critical-severity exploit in the SynergyX wallet, daemon, or protocol.
That means: actual fund loss, private key recovery, signature forgery, daemon denial-of-service, escrow drain, nonce collision, side-channel key extraction, or anything else that would make a security engineer lose sleep. If it's real, we pay. No committees. No 90-day review boards. You prove it, we verify it, you get paid on-chain.
What Qualifies
Critical Severity Only
We're not paying for typos, UI glitches, or "the runes in your source code are scary." This is for real vulnerabilities with real impact:
- Fund Loss — Any path that allows unauthorized transfer of SYNX from a wallet
- Key Recovery — Extracting SPHINCS+ private keys, seed phrases, or master secrets from memory, disk, or network traffic
- Signature Forgery — Forging a valid SPHINCS+ signature without the private key
- Daemon Brick Bypass — Crashing or hijacking the daemon to manipulate consensus, balances, or block validation
- Escrow Drain — Exploiting Synergy Sea DEX escrow to steal funds from either party
- Nonce Collision — Producing an AES-256-GCM nonce reuse that leads to plaintext recovery
- Side-Channel Extraction — Timing attack, cache attack, power analysis, or memory forensics that recovers key material
- TLS Bypass — Defeating cert pinning to MITM wallet-daemon communication
- Staking Exploit — Manipulating stake rewards, double-staking, or phantom unstake
- DoS / Resource Exhaustion — Crashing the daemon or wallet with crafted input (not just "send a lot of requests")
Rules of Engagement
Submit via Telegram
Send your proof-of-concept to @SynergyXlabs on Telegram. Include:
- Description of the vulnerability
- Step-by-step reproduction instructions
- PoC code, scripts, or tooling used
- Video or terminal recording (optional but helps)
- Your preferred payout address and currency
Must Be Reproducible on Mainnet
Your exploit must work against the live SynergyX mainnet. Testnet-only bugs don't count. Genesis block hash for verification:
0x0000...
Contact @SynergyXlabs for the full genesis hash if you're ready to begin.
Bounty Paid On-Chain
After we verify your PoC, you'll receive an escrow address. Payment is made on-chain — no PayPal, no wire transfers, no IOUs. $10,000 USD equivalent in USDC or your preferred supported crypto. Transparent and trustless, same as the protocol.
No Low-Severity Noise
The following do not qualify:
- Informational findings ("this header is missing")
- Self-DoS (crashing your own wallet)
- Social engineering or phishing vectors
- "The obfuscated code looks weird" — yes, it's supposed to
- "The runes are scary" — they're Elder Futhark, not a hex curse (or maybe they are)
- Theoretical attacks without a working PoC
- Bugs in third-party dependencies unless you can chain them into a SynX-specific exploit
We Reserve the Right to Reject
If your submission is "I decompiled the binary and the variable names gave me a headache" — that's by design, not a vulnerability. We reserve the right to reject submissions that don't demonstrate real-world exploitability.No demonstrating but look I can get into my own privatekey from my PC (yeah no shit goodjob it's self custodial)! No hard feelings. Come back when you have something real.
90-Day Window
This bounty program is active for 90 days from March 1, 2026. Submissions received after May 30, 2026 are not guaranteed a payout under this program, though we may choose to honor exceptional findings at our discretion.
What You're Up Against
Just so we're clear about what you're trying to crack:
| Layer | Protection |
|---|---|
| Key Exchange | Kyber-768 (NIST FIPS 203) — lattice-based, quantum-resistant |
| Signatures | SPHINCS+-SHAKE-128f+Runic lattices (NIST FIPS 205) — hash-based, stateless |
| Transport | TLS 1.3 with certificate pinning |
| Encryption | AES-256-GCM with Kyber-derived shared secrets |
| Secret Storage | DPAPI (Windows), Keychain (macOS), AES-GCM file vault (Linux) |
| Memory | Multi-pass Gutmann wipe, volatile writes, cache-line alignment |
| Anti-RE | Elder Futhark identifier obfuscation, XOR-split secrets, decoy arrays, dead code paths |
| Anti-Debug | IsDebuggerPresent, ptrace, timing jitter, parent process analysis, profiler env detection |
| Mining | Argon2d memory-hard PoW |
Responsible Disclosure
If you find something real, we ask that you give us 72 hours to acknowledge and begin remediation before any public disclosure. We won't drag our feet — if it's legit, we'll have a patch in progress within 48 hours. In return, you get credited (pseudonym or real name, your choice) in our security advisory, permanent respect from the team, and $10,000 in your wallet.
If you disclose publicly before giving us a chance to fix it, the bounty is void. Don't be that person.
Contact
Telegram: @SynergyXlabs
DM with subject line: BOUNTY: [Brief Description]
Think you're smarter than THE Daemon?
Prove it.
Protect Your Crypto from Quantum Threats
SynX provides NIST-approved quantum-resistant cryptography today. Don't wait for Q-Day.
Get Started with SynX.ᐟ.ᐟ Essential Reading
The Quantum Reckoning: Why SynX Is the Last Coin That Matters →The 777-word manifesto on crypto's quantum apocalypse.