OKX Labs

OKX Labs

@OKXlabs
LiveCantina-Triaged

Maximum reward

$1,000,000

Severity

Max. Reward

Critical

$1,000,000

High

$100,000

Medium

$10,000

Deposit required

$10

Findings submitted

548

Start date

30 Jan 2026

KYC

Required to join

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Smart Contracts

Severity

Min and Max Reward

Critical

Up to $1,000,000

High

Up to $100,000

Medium

Up to $10,000

LowDiscretionary

In-scope smart contract repositories.

Note: Actual reward amounts are determined at OKX Labs’ sole discretion. Key factors include report quality, completeness of technical details, clarity of PoC, and real-world exploitability.

Name
Description
Asset
DEX-Router-EVM-V1

Contracts on various chains as specified here

https://github.com/okxlabs/DEX-Router-EVM-V1/tree/main

DEX-Router-Solana-V1

Contracts on solana as specified here

https://github.com/okxlabs/DEX-Router-Solana-V1/tree/main

DEX-Router-Sui-V1

Contracts on SUI as specified here

https://github.com/okxlabs/DEX-Router-Sui-V1/tree/main

DEX-Router-Aptos-V1

Contracts on Aptos as specified here

https://github.com/okxlabs/DEX-Router-Aptos-V1/blob/main

Web3-DEX-EVM-PMM

Contracts on various chains as specified here

https://github.com/okxlabs/Web3-DEX-EVM-PMM/tree/main

Boost-TokenDistributor-Solana

Contracts on solana as specified here

https://github.com/okxlabs/…/tree/main

Boost-TokenDistributor-EVM

Contracts on various chains as specified here

https://github.com/okxlabs/Boost-TokenDistributor-EVM/tree/main

Boost-Token-Locker

Contracts on various chains as specified here

https://github.com/okxlabs/Boost-Token-Locker/tree/main

okx-smart-wallet-evm

A modular and secure smart contract wallet implementation unifying EOA and smart contract accounts with support for multiple execution patterns and advanced security features.

https://github.com/okxlabs/okx-smart-wallet-evm/tree/main

Out of scope

The following are explicitly excluded from the program scope:

  • Contracts deployed on testnets, devnets, or mainnets for testing/internal use only.
  • Third-party dependencies, third-party contracts integrated by OKX Labs, or code not under direct OKX Labs control.
  • Repository branches other than main.
  • Issues identified in previous security audits or reviews.
  • Vulnerabilities in non-standard ERC20 tokens (unless explicitly supported by the project).
  • Rounding errors with no material impact on users or funds.
  • User errors caused by obviously incorrect parameter inputs.
  • Vulnerabilities that only manifest under extreme market conditions.
  • Incorrect data from third-party oracles (note: oracle manipulation and flash loan attacks remain in scope).
  • Theoretical exploits without a practical, reproducible proof-of-concept.
  • Issues requiring access to leaked private keys, credentials, or privileged accounts.
  • Vulnerabilities arising from Sybil attacks.
  • Centralization risks, basic economic/governance attacks (e.g., 51% attacks), or protocol design choices.
  • Gas optimization issues, high gas costs, or best practice suggestions.
  • Submissions generated entirely by ChatGPT or other LLM tools (unless supplemented with original validation and analysis).