Rain Bug Bounty

Rain is a stablecoin payments platform for the tokenized future. Through a single API, Rain helps companies launch stablecoin-powered cards, manage digital dollar accounts, and move money across borders on modern settlement rails.

Severity Definitions

• Critical: Theft or freezing of collateral without a privileged signer; admin or authority takeover; signature or authorization bypass; unauthorized upgrade.
• High: Theft requiring a single privileged co-signer; permanent denial of withdrawals; treasury misdirection.
• Medium: Temporary denial of service; griefing with cost to users; invariant violation without direct loss.
• Low: Informational issues requiring a code change.

In addition to the above definitions, we will also use the Cantina Bug Bounty Severity Classification Framework to determine severity.

Prohibited Actions

• No testing against mainnet deployments. All findings must include a working proof of concept against a fork or an unsigned simulation.
• No public disclosure of a finding before it has been resolved and disclosure has been coordinated with Rain and Cantina.
• Researchers may not exploit a vulnerability beyond what is necessary to demonstrate impact, and must not access, modify, or exfiltrate real user or tenant funds or data.
• Individuals who contributed code to the in-scope repositories, or who are involved in a prior or ongoing audit of this codebase, may not submit findings related to that work.

Eligibility

• Open to all Cantina researchers meeting Cantina's standard eligibility requirements.
• Participants must not be residents of, or located in, any OFAC-sanctioned jurisdiction, nor appear on any OFAC sanctions list.
• Rain employees, contractors, and their immediate family members are not eligible to participate.
• KYC is not required to participate in this program.

Other Terms

• Duplicate findings and findings already described in the published audit reports for the in-scope version are not eligible for a reward.
• Issues already known to Rain internally at the time of submission are not eligible for a reward.
• Payment and disclosure timelines follow Cantina's standard bug bounty process.
• By submitting a finding, researchers agree to Cantina's Terms of Service and this program's rules.