Help keep meemz.bet safe. Report vulnerabilities in our smart contracts and earn up to $500,000 in rewards.
01 / Rewards
All rewards paid in USDC. Critical rewards subject to KYC. Reward amounts at sole discretion of meemz.bet security team based on severity, likelihood, and quality of report.
02 / Scope
03 / Process
All reports must be submitted through our Immunefi program page. This ensures encrypted communication, anonymous reporting, and protects both parties. Do NOT disclose publicly before resolution.
immunefi.com/bounty/meemzbetsYour report must include a working proof of concept demonstrating the vulnerability. This can be a unit test, a transaction on devnet, or a script. Reports without PoC will be deprioritised. The clearer your report, the faster we can triage.
We aim to acknowledge all reports within 24 hours. You'll receive an initial severity assessment within 72 hours. Our team operates globally across UTC-8 to UTC+9.
Once a valid vulnerability is confirmed, we work to patch and deploy a fix, then pay the reward within 14 days of final confirmation. KYC is required for rewards above $10,000.
04 / Rules
Do not disclose any vulnerability publicly before it has been fully remediated. This includes social media, Discord, GitHub, or any other public channel. Premature disclosure voids eligibility for reward.
Do not exploit a discovered vulnerability beyond what is necessary to prove the concept. Do not profit from the vulnerability, access user data, or disrupt protocol operations. Any exploitation voids the bounty and may result in legal action.
Act in good faith. Do not use social engineering, phishing, or physical attacks on meemz team members. Automated scanning that could impact production stability is prohibited.
Only the first researcher to report a unique vulnerability is eligible for the reward. If the same bug is reported by multiple researchers, the reward goes to the earliest valid report with a working PoC.
meemz.bet provides full safe harbour to security researchers acting in good faith and in accordance with these rules. We will not pursue legal action against researchers who follow this programme's guidelines.
The programme is open to everyone except meemz team members, contractors, and residents of countries subject to relevant sanctions laws. KYC may be required for reward claims above $10,000 per applicable law.
Security researchers are an essential part of keeping DeFi safe. If you've found a vulnerability, we want to hear from you — and reward you for it.
05 / FAQ