Zkme Vulnerability Disclosure

generated: '2026-07-21'
method: searched
source: https://docs.zk.me/hub/explore/bounty
probe: false
description: >-
  zkMe runs a self-hosted bug bounty program documented in its resources
  section. No third-party platform (Immunefi / HackerOne / Bugcrowd) is used;
  reports go to the security contact and payouts are made in USD/USDC/USDT.
policy: [https://docs.zk.me/hub/explore/bounty]
contact: [contact@zk.me]
response_time: 48 hours
testing_scope: private testnets only
poc_required: true
rewards:
  - severity: Critical
    amount: "$5,000-$10,000 (1% of assets at risk)"
  - severity: High
    amount: "$2,000-$5,000 (1% of assets at risk)"
  - severity: Medium
    amount: "$500-$2,000 (1% of assets at risk)"
  - severity: Low
    amount: "$500"
out_of_scope:
  - Theoretical risks without PoC
  - Previously exploited attacks
  - Attacks requiring leaked credentials
  - DoS / traffic-related attacks
  - Oracle issues (excluding manipulation / flash loans)
  - 51% attacks, Sybil attacks
evidence:
  - source: https://docs.zk.me/hub/explore/bounty
    kind: bug-bounty-page