Security & Bug Bounty

PredictAsiaX runs a coordinated disclosure program with cash rewards. Every fill is written to a hash-chained, Merkle-batched, R2-anchored audit log — but code is written by humans and humans miss things. Report responsibly; we pay in USDT within 30 days of validation.

In-scope surfaces

api.predictasiax.com — REST + WebSocket, plus /v1/audit/* Merkle proof endpoints
connect.predictasiax.com — OAuth 2.1 identity provider (PKCE mandatory, refresh rotation)
mcp.predictasiax.com — 41-tool Model Context Protocol server (JSON-RPC 2.0)
widget.predictasiax.com — embeddable <predictasiax-market> web component
builder.predictasiax.com — first-party Builder Portal (session cookies + admin key)
docs.predictasiax.com — this site, including interactive Scalar playground
admin.predictasiax.com — operator console (X-Admin-Key gated)
Polygon on-chain anchor contract at anchor.predictasiax.com/contract
PAX SDK packages on npm (@predictasiax/api) and PyPI (pax-api)

Out of scope

Physical attacks, social engineering of PAX staff, phishing of end users
DDoS / volumetric attacks — Cloudflare handles
Missing security headers where no concrete impact is shown
Rate-limit bypass without cascade to state corruption or unauthorized fills
Vulnerabilities in third-party services we integrate (report to them; we will amplify)

Rewards

Severity	Reward (USDT)	Example
Critical	10,000 – 25,000	Steal funds from any wallet · forge fills without matching order · break the Merkle chain · leak `POLYGON_HOT_WALLET_PRIVATE_KEY`
High	2,000 – 8,000	Auth bypass · privilege escalation to admin · replay attack against HMAC · fee-split misdirection
Medium	500 – 1,500	IDOR on non-critical data · stored XSS in Portal · webhook signature forge
Low	100 – 400	Info disclosure without account takeover · reflected XSS in low-traffic path

Bounties are paid from the PAX Insurance pool (funded from 5% of AMM house edge, see Fee Architecture Layer 4). First valid report on a duplicate wins; late duplicates receive $100 goodwill credit.

How to report

Send an encrypted email to [email protected]. PGP key fingerprint D5A2 8B14 F09E 7CC1 6F31 · 8B2C 7A4D 91E0 F5B7 A0D9. Download the key at /assets/pax-security.asc.

Include:

Reproducer (curl / video / minimal code)
Impact assessment (which surface, what an attacker can do)
Suggested fix if you have one
Your USDT payout address (BEP20 / Polygon / TRC20 preferred)

Response SLA

Acknowledgment — within 24 hours (Asia business hours), 48 hours off-hours
Triage & severity assignment — within 3 business days
Patch — critical in 24 h, high in 7 d, medium in 30 d, low in 90 d
Payout — within 30 days of triage; you approve public disclosure copy

Safe harbor

Good-faith research covered under a legal safe harbor: we will not pursue legal action for testing that (1) stays within scope, (2) does not degrade service for others, (3) does not extract data beyond what's needed to demonstrate the flaw, and (4) discloses privately to us before any public write-up. If your test crosses a line by accident, tell us immediately — we treat honest mistakes as goodwill.

Hall of fame

Public list of researchers who have shipped valid reports. Empty at launch — be the first, we amplify.

— open —

What we already invest in. Hash-chained event log ➞ 60-second Merkle roots ➞ R2-signed anchors ➞ monthly Polygon commit. Every fill you find is either provable or provably absent. See the public verifier. All secrets stored in Cloudflare Workers secret store or GCP Secret Manager. Root wallet keys never leave the VM signer. CSP hardened on every SPA (script-src 'self', no unsafe-inline).