OKX Labs

@OKXlabs

Live

Maximum reward

$1,000,000

Severity

Max. Reward

Critical

$1,000,000

High

$100,000

Medium

$10,000

Deposit required

$10

Findings submitted

173

Start date

30 Jan 2026

KYC

Required to join

Please sign in as a researcher to join the bounty.

Instructions Scope

In scope

Smart Contracts

Severity

Min and Max Reward

Critical

Up to $1,000,000

High

Up to $100,000

Medium

Up to $10,000

LowDiscretionary

In-scope smart contract repositories.

Note: Actual reward amounts are determined at OKX Labs’ sole discretion. Key factors include report quality, completeness of technical details, clarity of PoC, and real-world exploitability.

Name	Description	Asset
DEX-Router-EVM-V1	Contracts on various chains as specified here	https://github.com/okxlabs/DEX-Router-EVM-V1/tree/main
DEX-Router-Solana-V1	Contracts on solana as specified here	https://github.com/okxlabs/DEX-Router-Solana-V1/tree/main
DEX-Router-Sui-V1	Contracts on SUI as specified here	https://github.com/okxlabs/DEX-Router-Sui-V1/tree/main
DEX-Router-Aptos-V1	Contracts on Aptos as specified here	https://github.com/okxlabs/DEX-Router-Aptos-V1/blob/main
Web3-DEX-EVM-PMM	Contracts on various chains as specified here	https://github.com/okxlabs/Web3-DEX-EVM-PMM/tree/main
Boost-TokenDistributor-Solana	Contracts on solana as specified here	https://github.com/okxlabs/…/tree/main
Boost-TokenDistributor-EVM	Contracts on various chains as specified here	https://github.com/okxlabs/Boost-TokenDistributor-EVM/tree/main
Boost-Token-Locker	Contracts on various chains as specified here	https://github.com/okxlabs/Boost-Token-Locker/tree/main

Out of scope

The following are explicitly excluded from the program scope:

Contracts deployed on testnets, devnets, or mainnets for testing/internal use only.
Third-party dependencies, third-party contracts integrated by OKX Labs, or code not under direct OKX Labs control.
Repository branches other than main.
Issues identified in previous security audits or reviews.
Vulnerabilities in non-standard ERC20 tokens (unless explicitly supported by the project).
Rounding errors with no material impact on users or funds.
User errors caused by obviously incorrect parameter inputs.
Vulnerabilities that only manifest under extreme market conditions.
Incorrect data from third-party oracles (note: oracle manipulation and flash loan attacks remain in scope).
Theoretical exploits without a practical, reproducible proof-of-concept.
Issues requiring access to leaked private keys, credentials, or privileged accounts.
Vulnerabilities arising from Sybil attacks.
Centralization risks, basic economic/governance attacks (e.g., 51% attacks), or protocol design choices.
Gas optimization issues, high gas costs, or best practice suggestions.
Submissions generated entirely by ChatGPT or other LLM tools (unless supplemented with original validation and analysis).