Program Overview The Terraport Bug Bounty Program invites ethical hackers and security researchers to identify and disclose security vulnerabilities in Terraport’s smart contracts and web applications. This initiative is part of Terraport’s proactive approach to fortifying its ecosystem and protecting user assets.

Reward Structure All bug submissions are evaluated using a standardized 4-level severity model, with reward amounts determined by both the criticality of the issue and the type of affected component (e.g., smart contract vs. website/app). For critical smart contract vulnerabilities, rewards are capped at 10% of the estimated economic damage, taking into account the funds at risk as well as potential reputational impact, at the team’s discretion. High-severity vulnerabilities may be rewarded with up to 100% of the funds affected, based on the evaluation at the time the report is submitted.

Submission Requirements To be eligible for a bounty, bug reports must include a functioning proof of concept (PoC) and detailed reproduction steps showing the exploit’s impact on in-scope assets. Reports lacking executable code will not be considered valid.

Payouts All approved rewards are paid in USD, and disbursed directly by the Terraport team upon successful validation and completion of KYC.