How to check if a swap provider has an active bug bounty or security contact

05 September 2026

Look for a dedicated security page on the provider's website, or check the footer for a "Security" or "Responsible Disclosure" link. If the site lists an email address specifically for reporting vulnerabilities, and that address is not the same as general customer support, the provider likely has an active security contact. For a bug bounty, check third-party platforms like Immunefi, HackerOne, or Bugcrowd - many reputable swap providers list their bounties there.

Why this matters: a provider with a live bug bounty or a clear security contact has invested in finding and fixing flaws before they can be exploited. It signals that the team treats security as an ongoing process rather than a one-time setup. Without such a contact, a vulnerability you discover might never reach the right person, and attackers could find it first.

Start with the provider's own site. Look at the footer or the "About" page. Common phrasing includes "Security," "Responsible Disclosure," "Bug Bounty," or "Report a Vulnerability." If you find a page, read the terms carefully. Some bounties only cover specific software versions or exclude certain types of bugs. If the page is dated more than a year ago, the bounty may be inactive - check for recent updates or a status indicator.

Next, search the provider's domain on bug bounty platforms. Immunefi is the most common for crypto projects. Enter the domain in the platform's search bar. If a bounty is listed, the platform will show its scope, reward range, and whether it is currently active. HackerOne and Bugcrowd work similarly. If the provider runs its own bounty without a platform, look for a separate page that lists past payouts or a changelog of fixed issues. A provider that has never paid a bounty or has no public record of fixes may not be serious about the program.

Check for a PGP key or an encrypted contact method. Serious security teams often publish a PGP key for reporting sensitive vulnerabilities. If the only contact is a generic support form, your report may land in a queue that nobody reviews for security issues.

If you find nothing, consider the provider's reputation. A newer or smaller swap site may not yet have a formal bounty, but a clear security contact email still shows intent. Compare what you find with what sibling pages in the "Swapping crypto safely" hub cover - for example, if the provider lacks a security contact, you may want to test their deposit address with a tiny amount first, as described in another page. That page explains how a small test can reveal issues that a security contact might have caught.

Remember that an active bounty does not guarantee the provider will respond to your report quickly or pay fairly. Some bounties are purely symbolic. But the presence of a structured program is a stronger signal than a vague "contact us about bugs" line.

If you find a security issue, report it exactly as the provider requests. Screenshot the bounty terms and your submission confirmation. Do not disclose the vulnerability publicly until the provider has fixed it. If they do not respond within a reasonable time, you may need to decide whether to use the provider at all.

In short: the first check is on the provider's site. The second is on bug bounty platforms. The third is for a PGP key or dedicated security email. If none exist, treat the provider as having no active security process. That does not mean the provider is unsafe, but it means you are relying on their operational security alone. For the broader context of what to do when something goes wrong, the hub page "Swapping crypto safely" covers the full set of checks and fixes.

Back to perpetuals