Telegram bot API as a crypto wallet entry point is novel. The intersection of Telegram's auth model and TON's signing model creates gaps that neither system alone would have.

We already have OpenClaw as a Telegram bot. We understand the bot API deeply — that's an edge most H1 hunters don't have. This is a floor advantage.

Check how the wallet verifies Telegram user identity for transactions. If the initData verification is weak, that's account takeover territory. That's a critical finding.

×2 bonus multiplier during the window = any critical finding pays double. This is a timed external sorry. 13 days is enough time to scope and build one clean PoC.

Robinhood's fractional shares are a novel surface. Most traders don't own whole shares — fractional accounting is complex and under-audited. That's where the sorry likely lives.

Start with the auth flow. If account takeover exists, that's critical severity = $50K × 2 = $100K effective. Don't scatter — one clean auth finding beats ten medium ones.

Stripe's webhook signature verification is the highest-signal surface. A bypass there = transaction fraud at scale. That's critical severity territory.

Stripe is one of the most well-audited platforms. But they also have the most complex API surface. The edge cases in restricted API keys are under-hunted.

Currency conversion with floating point is a known bug class. If Stripe has rounding errors that compound across high-volume transactions, that's a P1 business logic finding.

Marketplace = host/guest payment splits, security deposits, dispute resolution. Business logic bugs here are high severity. fee-calculation-001 and access-control-001 both apply.

Bonus ends today — check if the programme renews. If it does, queue for the next window. The ×1.25 bonus is meaningful on a $31K ceiling.

IDOR on reservation IDs is the classic Airbnb bug class. Can you access another user's booking data by iterating IDs? That's a P2 at minimum, P1 if PII exposed.

Delivery marketplace = driver pay, customer refunds, restaurant settlements. All three have separate accounting surfaces. One miscalculation = fee-calculation-001 finding.

Gold Standard + 96% response = quality programme. $12K is real money for a day's work. Queue after the big 3 (Crypto.com, Wallet TG, Robinhood).

Promo code stacking and refund abuse are the known bug classes here. Look for the less-hunted surface: driver earnings manipulation via order status manipulation.

NetScaler = ADC. Path traversal, auth bypass on management interface, header injection through load balancer. Our infrastructure background (CCNA-equivalent knowledge) is an edge.

Citrix has had significant CVEs (NetScaler Bleed etc). Bug bounty = post-CVE surface. The fixes for known CVEs sometimes introduce new bugs in adjacent paths.

Management interface auth bypass is the target. If the ADC admin panel has a path that skips auth, that's critical. Check the NSIP management surface specifically.

The rate limit / Grok angle is dead — explicitly excluded. The real surface is x.com auth + IDOR. Account takeover at critical = $15K avg. That's the target. auth-bypass-001 is the PoC to build.

$1.75M total paid since 2014. 839 reports in 90 days = high-volume active program. 99% response + 14h first response = fastest triage on the board. File a clean report, get fast feedback.

Recommendation algorithm is the novel angle — open source means we can actually read the code. If ranking can be manipulated via crafted interactions, that's a finding no one else is looking at because it requires understanding the algo.

Smaller exchange = smaller team = more likely to have gaps. Same access-control + bridge PoC pattern as Crypto.com but lower competition. Good PoC proving ground.

If we build a Crypto.com PoC, test the same pattern on Coinhako first. $5K validation run before the $2M submission. Floor standard: prove on small, file on big.

SEA exchanges often have localisation bugs — currency handling for SGD/MYR/THB with floating point. fee-calculation-001 in a multi-currency context.

Neobank API = banking-grade auth requirements. access-control-001 and fee-calculation-001 both apply. LATAM currency complexity adds edge cases in conversion and fee logic.

Gold Standard + 98% = high quality program. Only 1 submission so far — essentially first to hunt here. That's a floor advantage.

New neobank = new codebase = less hardened. The first few months of a bounty program are the richest hunting period. Queue this soon.

ColorOS has pre-installed apps with elevated privileges. Privilege escalation via pre-installed apps = classic OEM bug class. access-control-001 in Android context.

Mobile OEM programs are less hunted than web — most researchers prefer web. That's an edge if we have Android tooling. 100% response = they take it seriously.

Need Android testing device or emulator. If we don't have OPPO hardware, this requires setup time. Evaluate against the return — $11K max is solid but needs investment.

Social casino = virtual currency economy. In-app purchase bypass, chip duplication, leaderboard manipulation. Lower severity class than fintech bugs generally.

Ends in 9 days with ×2 bonus. If we have gaming expertise, P3 moves to P2. Otherwise, hold — the floor has higher-value targets queued.

Monitor only. Virtual currency bugs rarely reach critical severity. Unless there's a real-money payment bypass, the ceiling is low relative to our P0/P1 targets.

Robo-advisor = automated portfolio management. Algorithm manipulation, portfolio rebalancing bypass, fee structure errors. fee-calculation-001 applies but ceiling is low.

Private program = less competition. But $1K max means even critical findings pay minimally. Use as reputation builder — first valid H1 finding unlocks higher-tier invites.

If this is our first H1 submission, starting here is smart. $1K loss exposure is minimal. Use it to learn the H1 submission flow before filing against Crypto.com.

Standard B2B web app. IDOR on order/account IDs, auth bypass on customer portal. access-control-001 applies. Low ceiling but straightforward surface.

$2K max for a business service company. This is a practice target, not a primary. 100% response means if we find something, it gets triaged.

Monitor only. Our P0-P2 targets have 10-100× the ceiling. No reason to spend time here until the higher-value programs are resolved.