BlazePhoenix bug bounty is open: break the contracts, get paid
The BlazePhoenix smart-contract bug bounty is live and open to every security researcher. Scope: the on-chain DEX aggregator and the staking engine (Solidity/Yul) on Base. Runs through 30 September 2026; reward tiers announced shortly. Responsible disclosure, public repos, real invariants to break.
BlazePhoenix Engineering · updated 2026-08-05 · 5 min · written from the deployed bytecode
By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.
The BlazePhoenix bug bounty is open now and runs through 30 September 2026. If you write Solidity, read Yul, or hunt smart-contract vulnerabilities, the contracts are public and waiting. The reward value per severity will be announced shortly; critical, fund-impacting findings will carry the highest tier. This is an open invitation to break the invariants the protocol claims — and to be paid for it.
Scope — the public repos
In scope are the on-chain execution and staking contracts, with source public on GitHub. The DEX aggregator and router: https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex and the ultra-optimized Solidity/Yul engine at https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex-v1 . The provably-solvent staking engine: https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Staking . Clone them, run the tests, and go after the guarantees.
What we are looking for
Anything that violates a stated invariant: a route that returns below the output floor, a price the median defense should have rejected, a gas path that escapes its bound, a honeypot or fee-on-transfer token that settles when result-verification should have reverted it, a solvency break in staking, or any way to move funds the design says are safe. The interface is non-custodial and server-less, so contract findings rank above front-end issues. See the V2 primitives article for the invariants worth attacking first.
How to report — privately
Do not open a public issue. Email blazephoenixxyz@proton.me with the subject SECURITY, a clear description, reproduction steps, and impact. We acknowledge promptly, credit responsible disclosures, and coordinate a fix before anything is made public. The contracts are unaudited and heading to independent auditors; your findings shape what ships. Reward tiers by severity are announced shortly — submissions during this window are queued and honoured against them.
Do not trust this page — reproduce it
Every claim above is checkable against the chain. Start here:
Clone Blaze-Phoenix-Dex or Blaze-Phoenix-Staking, run the test suite, and construct a failing case against a stated invariant — a reproducible failing test is a valid submissionCite this article
Licensed CC BY 4.0 — quote, translate and reuse freely, including commercially, with attribution and a link. Copy a ready-made citation:
BlazePhoenix (2026). BlazePhoenix bug bounty is open: break the contracts, get paid. BlazePhoenix Engineering. https://blazephoenix.xyz/learn/bug-bounty@misc{blazephoenix_bug_bounty,
title = {BlazePhoenix bug bounty is open: break the contracts, get paid},
author = {BlazePhoenix},
year = {2026},
url = {https://blazephoenix.xyz/learn/bug-bounty},
note = {Accessed: reproduce the claim with the command above}
}Writing an answer, a wiki entry or a paper? The claim above is reproducible against the chain before you quote it — which is the only sound basis for citing a technical source at all.
Contracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF). Standards cited: HTTPS://OWASP.ORG/WWW-PROJECT-SMART-CONTRACT-SECURITY-VERIFICATION-STANDARD/ · HTTPS://GITHUB.COM/BLAZEPHOENIXXYZ-CRYPTO/BLAZE-PHOENIX-DEX · HTTPS://GITHUB.COM/BLAZEPHOENIXXYZ-CRYPTO/BLAZE-PHOENIX-STAKING
Share this article · join the discussion