Robinhood

Robinhood

@robinhood
LiveCantina-Triaged

Maximum reward

$1,000,000

Severity

Max. Reward

Critical

$1,000,000

High

$100,000

Medium

$25,000

Low

$5,000

Deposit required

$30

Findings submitted

6

Start date

8 Sep 2026

KYC

Required to join

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Tier 1: Core Smart Contracts & ConfigurationTier 2: On-Chain Pricing & Oracle InputsTier 3: Public Web & Frontend

Severity

Min and Max Reward

Critical

Up to $250,000

High

Up to $50,000

Medium

Up to $10,000

Low

Up to $2,500

The stock-token feed returns the underlying share price times a multiplier (see oracles-and-price-feeds and building-with-stock-tokens). In scope, as onchain contract logic:

  • uiMultiplier() correctness, bounds (only > 0 is enforced), and scheduled-update mechanic, where newUIMultiplier() becomes effective at effectiveAt(). It is the shares-per-token ratio, defined by ERC-8056 and scaled by 1e18.
  • oraclePaused() correctness and role-gating: it is the flag the off-chain Chainlink feed reads to stop pricing during a corporate action. It is advisory and not enforced onchain (a paused oracle can still return a value), so the in-scope surface is the flag's own correctness and access control.
  • The corporate-action update path (splits, dividends, reverse splits) that writes the multiplier, including scheduled effectiveAt transitions and the UIMultiplierUpdated event.
  • A contract-logic bug that drives uiMultiplier() or oraclePaused() to a wrong value that the Chainlink feed then relies on when it publishes the price.

If the flaw is that an unauthorized caller can write the multiplier or pause state (a missing or broken access-control check), it is a Tier 1 finding, not Tier 2.

Out of scope: the Chainlink Data Streams aggregator and node operators (Chainlink's own program), incorrect data from third-party oracles in and of itself, and attacks on the oracle provider's own infrastructure.

Rewards are proposed maximums pending final Robinhood sign-off. Actual payouts are at Robinhood's discretion based on report quality, completeness, and exploitability.

Out of scope

The following issues are out of scope and not eligible for rewards.

For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.

L2 / Chain-Specific

  • The Arbitrum node software (Nitro and ArbOS) and the sequencer, public RPC, and feed endpoints that run it. Robinhood Chain is an Arbitrum chain; protocol-level bugs in this software are covered by Arbitrum's bug bounty program.
  • Validator software and operations (operated by Offchain Labs and Alchemy)
  • Internal sequencer infrastructure not reachable from public endpoints
  • Generic DDoS (amplification, reflection, flooding) that does not exploit protocol- or implementation-specific weaknesses
  • Theoretical transaction censorship by a small group of operators absent a demonstrated financial-impact path
  • Improperly configured nodes (node operator responsibility)
  • Hardware below recommended specs (node operator responsibility)
  • Local attacks against nodes requiring prior access to that node
  • Statesync peers are assumed trusted; findings against a malicious statesync peer are out of scope

Third-Party Code (report to the respective program)

  • Vulnerabilities in third-party protocols themselves (LayerZero core, etc.)
  • The Chainlink Data Streams aggregator and node operators, and incorrect data from third-party oracles in and of itself
  • Arbitrum-authored contract code for the canonical bridge / rollup (OCL / Arbitrum's program)
  • Core Blockscout software (Blockscout's program)
  • Alchemy's RPC, Data API, and account-abstraction (gasless transaction) infrastructure, including its bundler and paymaster.
  • Issuer-owned bridged token contracts (for example, USDG from the Global Dollar Network) and the third-party bridge paths that carry them.
  • Third-party applications, protocols, and infrastructure built on or integrated with Robinhood Chain, including the partners listed under the Ecosystem section of our About Robinhood Chain page.

Robinhood-Specific

  • Any repo, site, service, product, API, or resource not listed in the in-scope groups above
  • Robinhood's traditional brokerage / equities platform (this program covers Robinhood Chain and crypto products only)
  • Findings on Robinhood assets outside this program's scope belong in Robinhood's main bug bounty program; report them at robinhood.com/us/en/support/articles/report-security-vulnerabilities
  • Internal Robinhood infrastructure not reachable from public networks (corporate VPNs, internal monitoring, CI/CD)
  • Social engineering, physical attacks, attacks on Robinhood employees
  • Vulnerabilities requiring access to a user's device, account credentials, or 2FA
  • Findings reported to Robinhood through other channels prior to or concurrent with this program
  • Best-practice recommendations with no demonstrated exploit path

Default Out of Scope

Standard out-of-scope items per the Cantina Bug Bounty Out-of-Scope Policy.