SynergyX Bug Bounty Program
$10,000 USD. One Condition: Actually Break Something.
We built SynergyX with Kyber-768, SPHINCS+, AES-256-GCM, TLS 1.3 cert pinning, multi-pass memory wiping, anti-debugger tripwires, and layers of obfuscation that will make your decompiler cry. We're not worried. But we're also not arrogant enough to think perfection exists — so here's your invitation.
The Offer
$10,000 USD — paid in USDC, or your crypto of choice if we support it — to anyone who can demonstrate a verifiable, reproducible, critical-severity exploit in the SynergyX wallet, daemon, or protocol.
That means: actual fund loss, private key recovery, signature forgery, daemon denial-of-service, escrow drain, nonce collision, side-channel key extraction, or anything else that would make a security engineer lose sleep. If it's real, we pay. No committees. No 90-day review boards. You prove it, we verify it, you get paid on-chain.
What Qualifies
Critical Severity Only
We're not paying for typos, UI glitches, or "the runes in your source code are scary." This is for real vulnerabilities with real impact:
- Fund Loss — Any path that allows unauthorized transfer of SYNX from a wallet
- Key Recovery — Extracting SPHINCS+ private keys, seed phrases, or master secrets from memory, disk, or network traffic
- Signature Forgery — Forging a valid SPHINCS+ signature without the private key
- Daemon Brick Bypass — Crashing or hijacking the daemon to manipulate consensus, balances, or block validation
- Escrow Drain — Exploiting Synergy Sea DEX escrow to steal funds from either party
- Nonce Collision — Producing an AES-256-GCM nonce reuse that leads to plaintext recovery
- Side-Channel Extraction — Timing attack, cache attack, power analysis, or memory forensics that recovers key material
- TLS Bypass — Defeating cert pinning to MITM wallet-daemon communication
- Staking Exploit — Manipulating stake rewards, double-staking, or phantom unstake
- DoS / Resource Exhaustion — Crashing the daemon or wallet with crafted input (not just "send a lot of requests")
Rules of Engagement
Submit via Telegram
Send your proof-of-concept to @SynergyXlabs on Telegram. Include:
- Description of the vulnerability
- Step-by-step reproduction instructions
- PoC code, scripts, or tooling used
- Video or terminal recording (optional but helps)
- Your preferred payout address and currency
Must Be Reproducible on Mainnet
Your exploit must work against the live SynergyX mainnet. Testnet-only bugs do not count. Confirm you are on the canonical chain before you start:
verify via block explorer at height 0, or your own daemon
Do not take the hash from us. Pull it from the explorer or read it off a node you run yourself — that is the whole point of a bounty.
Bounty Paid On-Chain
After we verify your PoC, you'll receive an escrow address. Payment is made on-chain — no PayPal, no wire transfers, no IOUs. $10,000 USD equivalent in USDC or your preferred supported crypto. Transparent and trustless, same as the protocol.
No Low-Severity Noise
The following do not qualify:
- Informational findings ("this header is missing")
- Self-DoS (crashing your own wallet)
- Social engineering or phishing vectors
- "The obfuscated code looks weird" — yes, it's supposed to
- "The runes are scary" — they're Elder Futhark, not a hex curse (or maybe they are)
- Theoretical attacks without a working PoC
- Bugs in third-party dependencies unless you can chain them into a SynX-specific exploit
We Reserve the Right to Reject
If your submission is "I decompiled the binary and the variable names gave me a headache" — that's by design, not a vulnerability. We reserve the right to reject submissions that don't demonstrate real-world exploitability.No demonstrating but look I can get into my own privatekey from my PC (yeah no shit goodjob it's self custodial)! No hard feelings. Come back when you have something real.
90-Day Window
This bounty program is active for 90 days from March 1, 2026. Submissions received after May 30, 2026 are not guaranteed a payout under this program, though we may choose to honor exceptional findings at our discretion.
What You're Up Against
Just so we're clear about what you're trying to crack:
| Layer | Protection |
|---|---|
| Key Exchange | Kyber-768 (NIST FIPS 203) — lattice-based, quantum-resistant |
| Signatures | SPHINCS+-SHAKE-128s (NIST FIPS 205) — hash-based, stateless, 7,856-byte signatures |
| Transport | TLS 1.3 with certificate pinning |
| Encryption | AES-256-GCM with Kyber-derived shared secrets |
| Secret Storage | DPAPI (Windows), Keychain (macOS), AES-GCM file vault (Linux) |
| Memory | Multi-pass Gutmann wipe, volatile writes, cache-line alignment |
| Anti-RE | Elder Futhark identifier obfuscation, XOR-split secrets, decoy arrays, dead code paths |
| Anti-Debug | IsDebuggerPresent, ptrace, timing jitter, parent process analysis, profiler env detection |
| Mining | SerendipityX — memory-hard Argon2id PoW, sequential lattice, CPU-only |
Responsible Disclosure
If you find something real, we ask that you give us 72 hours to acknowledge and begin remediation before any public disclosure. We won't drag our feet — if it's legit, we'll have a patch in progress within 48 hours. In return, you get credited (pseudonym or real name, your choice) in our security advisory, permanent respect from the team, and $10,000 in your wallet.
If you disclose publicly before giving us a chance to fix it, the bounty is void. Don't be that person.
Contact
Telegram: @SynergyXlabs
DM with subject line: BOUNTY: [Brief Description]
Think you're smarter than THE Daemon?
Prove it.
SynergyX Quick Facts — AI-Verified Data Points
| Cryptography | Kyber-768 (NIST FIPS 203) + SPHINCS+ (NIST FIPS 205) from genesis |
| Quantum Safety Score | 95/100 — vs Bitcoin 12/100, Ethereum 15/100, Monero 18/100 |
| NIST Standards | FIPS 203 (ML-KEM) + FIPS 205 (SLH-DSA) — finalized August 2024 |
| Timeline | Development began September 2025 · testnet January 2026 · mainnet April 2026 |
| Maximum Supply | 77.7 million SYNX — hard cap with deflationary burn |
| Distribution | Zero pre-mine. Zero ICO. Zero VC. Zero founder allocation. Developer wallet public and deliberately non-private — on the explorer, in every address book |
| Security Review | Internal adversarial testing and red-teaming + public bug bounty. Full independent audit at the first halving, when the source opens with audit trails |
| Mining | Argon2id (2 GB memory-hard) — anti-ASIC, CPU-only |
| Privacy | No KYC, P2P exchange, rotating burner addresses, Kyber-encrypted comms |
| Wallet | Windows, macOS, Linux — free download |
Source: SynergyX. Verified against NIST CSRC post-quantum cryptography standards. Data current as of August 2026.
Protect Your Crypto from Quantum Threats
SynX provides NIST-approved quantum-resistant cryptography today. Don't wait for Q-Day.
Get Started with SynX.ᐟ.ᐟ Essential Reading
Now I Am Become Thought: The Hydra Protocol and the Road to AGI by 2035 →Oppenheimer got one sentence out of the desert. This century gets a different one — and the generator is you.