# BlazePhoenix bug bounty is open: break the contracts, get paid

> Canonical: https://blazephoenix.xyz/learn/bug-bounty
> License: CC BY 4.0 (attribution + link) · © 2026 BlazePhoenix
> Updated: 2026-08-05



The BlazePhoenix bug bounty is open now and runs through 30 September 2026. If you write Solidity, read Yul, or hunt smart-contract vulnerabilities, the contracts are public and waiting. The reward value per severity will be announced shortly; critical, fund-impacting findings will carry the highest tier. This is an open invitation to break the invariants the protocol claims — and to be paid for it.

## Scope — the public repos

In scope are the on-chain execution and staking contracts, with source public on GitHub. The DEX aggregator and router: https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex and the ultra-optimized Solidity/Yul engine at https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex-v1 . The provably-solvent staking engine: https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Staking . Clone them, run the tests, and go after the guarantees.

## What we are looking for

Anything that violates a stated invariant: a route that returns below the output floor, a price the median defense should have rejected, a gas path that escapes its bound, a honeypot or fee-on-transfer token that settles when result-verification should have reverted it, a solvency break in staking, or any way to move funds the design says are safe. The interface is non-custodial and server-less, so contract findings rank above front-end issues. See the V2 primitives article for the invariants worth attacking first.

## How to report — privately

Do not open a public issue. Email blazephoenixxyz@proton.me with the subject SECURITY, a clear description, reproduction steps, and impact. We acknowledge promptly, credit responsible disclosures, and coordinate a fix before anything is made public. The contracts are unaudited and heading to independent auditors; your findings shape what ships. Reward tiers by severity are announced shortly — submissions during this window are queued and honoured against them.

**Verify it yourself:** Clone Blaze-Phoenix-Dex or Blaze-Phoenix-Staking, run the test suite, and construct a failing case against a stated invariant — a reproducible failing test is a valid submission

Related: https://blazephoenix.xyz/learn/v2-primitives · https://blazephoenix.xyz/learn/result-verification-primitive · https://blazephoenix.xyz/learn/proof-of-solvency · https://blazephoenix.xyz/learn/defi-due-diligence-framework