Bug Bounty

Policy

TradeToli enables you to trade directly on the outcome of events. We've built a new financial exchange for you to trade on your opinion through event contracts. These contracts are structured as questions about whether a future event will happen and can be answered by a simple Yes or No.
We trade to express an opinion on whether a future event will drive the value of stocks up or down. You believe that vaccination is effective and you start buying hospitality stock. But these trades don’t provide you direct exposure to the event as you get dependent on the stocks you bought which have a direct impact on the events. TradeToli enables you to trade directly with the event and you can predict the outcome based on your knowledge and research and unlock value.

TradeToli is more concerned with keeping their user’s data secure thus we look forward to working with security researchers to find security vulnerabilities in the TradeToli.

For any query please drop us a mail at:  info@tradetoli.com

Rewards

if there are any system bugs or errors in the beta version, due to which any transactions that are created in system, then those transactions will be rollbacked to the original state.

The Bounty amount will be based on its severity, scope, and exploit level.

Program Rules

• Please provide us with a detailed report with all possible reproducible steps. If the report is not detailed enough to reproduce the issue, we may not entertain the report.
• Submit only one vulnerability per the report, unless it is linked.
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report and a bounty will be paid for one vulnerability.
• Phishing, vishing, and smishing kind of Social engineering is prohibited.

Hunting Guidance

• Please always work with a test account and it shouldn’t impact our users. We have various subscription plans but normal users are free of cost.
• If you want your user to be changed to another subscription for testing purposes you can request it at “info@tradetoli.com”.
• DOS testing is completely prohibited.
• We are more concerned with our user’s personal details thus the scope of the hunt can be in our frontend App or backend servers.

Out-of-Scope Vulnerabilities

Please consider the impact of the bug which is a more critical one. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able * to modify HTML/CSS
• Rate limiting or brute force issues on non-authentication endpoints.
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies.
• Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing.
• Open redirect - unless an additional security impact can be demonstrated.
• Issues that require unlikely user interaction.
• Absence of certificate pinning
• Lack of obfuscation.

Disclosure Policy

If you believe that you have discovered a vulnerability please report them to our provided email with all detail POC. And as soon as you submit your report you are bound by our disclosure policy which means you are not allowed to share/release any information about the found vulnerabilities to the public. When the bug is fixed with mutually agreed information, security researchers are allowed to share the information.

Report Email

info@tradetoli.com