40,000,000 BZPX for breaking our contracts
A paid security bounty across two protocols: an on-chain DEX aggregator and a solvency-enforced staking engine. The pool is 4% of a fixed one-billion supply, and it came out of the team's own allocation rather than the market float — 113M reduced to 93M. Which bucket a security budget is drawn from says more than its size does.
Three things stated first, because you deserve to decide with open eyes.
- Rewards are paid in BZPX, not in stablecoins or ETH. The token is not liquid at the time of writing, so we can promise the quantity and the schedule — not the value at the moment it is granted.
- Payouts begin after October 2026. Reports are accepted, triaged and acknowledged from now. If that timing does not suit you, waiting is entirely reasonable — the scope is not going anywhere.
- Severity is our assessment, and we will show our reasoning. Where we disagree with your rating we say why in writing rather than silently downgrading.
Awards
| Severity | Award | What it means |
|---|---|---|
| Critical | 2,000,000 – 6,000,000 BZPX | Direct theft or permanent freezing of user funds; a reachable insolvent state. |
| High | 500,000 – 2,000,000 BZPX | Theft under specific conditions, or a redistribution that systematically pays the wrong party. |
| Medium | 100,000 – 500,000 BZPX | Griefing, temporary denial of service, or recoverable residue reaching the wrong party. |
| Low | up to 100,000 BZPX | Demonstrated impact below the above. |
A report must be previously unknown to us and must demonstrate impact rather than describe a theoretical concern. Duplicates are settled by the timestamp of the first report received.
Scope
In scope: the DEX aggregator contracts — Router, Solver, Hub, Quoter, Core — and the staking engine, BlazePhoenixStaking and BlazePhoenixMathLib. Out of scope: third-party pools, tokens, bridges and RPC providers — but a vulnerability in how our contracts consume them is in scope.
Where reports land hardest
Both protocols are invariant-driven and fail closed, so the most valuable reports are the ones that defeat a stated invariant rather than the ones that find a rough edge. On the aggregator that means a path where the quoted output diverges from execution, where route weight can be sourced from self-reported pool state, or where the measured floor can be bypassed.
On the staking engine, note this carefully: a finding does not have to break conservation to be Critical. The guard can balance to the wei on every block and still hand the wrong person the money — six of the seven previously disclosed defects were pure redistribution, with the totals never changing. If your report shows that, do not downgrade it yourself because the books still add up. That is precisely the class we most want to hear about.
How to report
Privately, to contact@blazephoenix.xyz — never a public issue. Include the impact, the affected contract and file:line where possible, a minimal proof-of-concept or the exact reproduction conditions, and your own severity assessment. We aim to acknowledge within 72 hours and to keep you updated through triage and remediation.
Machine-readable contact: /.well-known/security.txt (RFC 9116).
Credit
Valid, previously-unknown findings are credited by the name or handle you choose, with your consent, whether or not an award applies. This is not a new promise: external researchers are already credited in the repository history for findings that shaped the contracts running today.