USA₮ Bug Bounty Rewards

Hunt, report, and get rewarded!

Tether believes that establishing relationships with security researchers and nurturing security research is a vital part of our mission to protect our users and ship safer software.

In collaboration with the cybersecurity and hacker development community, Tether runs this bug bounty program (“Bug Bounty Program”) to incentivise and reward the responsible disclosure of security vulnerabilities. Tether is always building and pushing out new code, so join our growing research community and help our developers to squash bugs with attractive rewards paid out to successful bugs discovered. On this Bounty Rewards Information Page and Guidelines, you can find the information you need to know relating to which products and services are in scope of the Bug Bounty Program, how to submit a Tether Bounty Report (defined below), and how to receive a reward for identifying a bug (“Bounty Reward”). All decisions in relation to the administration of the Bug Bounty Program are at Tether’s sole and absolute discretion, including the distribution of Bounty Rewards.

This Tether Bug Bounty Rewards Information Page and Guidelines deals with the USA₮ token smart contracts. Other Tether Bug Bounty Rewards Information Page and Guidelines may deal with other programs or businesses.

Responsible Disclosure Policy:

To ensure a quick fix, the disclosure as a user or organisation must work with the Tether security and development team in a confidential, timely and secure manner. Ensuring any vulnerabilities will be dealt with in the most secure manner, you must:

• submit your report once you discover the bug, the fastest way to alert our team is via our form at the bottom of this page;
• not share details of the bug in our customer support chat or publicly;
• make every effort not to interrupt or degrade our products or services during your investigation;
• not harm or defraud Tether systems, products, or our users during your investigation;
• only target your own accounts during your research for vulnerabilities;
• not violate the privacy of other users, destroy data, attempt to access or disrupt any other user accounts or data;
• provide written authority from the owner to perform such tasks, if working on behalf of a client or organisation where more than one account is used;
• ensure your Tether Bounty Report remains confidential and do not disclose information relating to your Tether Bounty Report publicly before it has been fixed;
• not engage in activity or provide a Tether Bounty Report that is false or misleading;
• not share any information relating to a vulnerability in Tether’s customer support group;
• not attempt social engineering or phishing techniques on our users or Tether personnel; and
• not engage in activity that is harmful to us, any of ours or our affiliates’ products, the Bug Bounty Program, or others, including to use software or perform attacks that could affect the stability of our platforms, such as DDOS attacks, spamming techniques or blackhat SEO.

If you violate this Responsible Disclosure Policy, you may be prohibited from participating in the Bug Bounty Program and any Tether Bounty Reports you have provided may be deemed to be ineligible for payments.

Bug Bounty Eligibility Requirements:

Please follow our Responsible Disclosure Policy above when working to discover security vulnerabilities and bugs. You may only participate in the Bug Bounty Program if (“Eligibility Requirements”):

• you fully accept and adhere to our bug bounty terms governing the Bug Bounty Program, which applies to you and can be found here: Bug Bounty Terms. (The Bug Bounty Terms should be read in conjunction with the Privacy Statement for the Bug Bounty Program.
• you are over 18 years old or the age of majority in the jurisdiction in which you reside;
• if you are representing an entity, (a) such entity is duly organized and validly existing under the applicable laws of the jurisdiction of its organization; and (b) you, the individual signing such entity up for the Bug Bounty Program, are duly authorized by such entity to act on its behalf and participate in the Bug Bounty Program;
• your participation in the Bug Bounty Program would not be in violation of any national, state, or local law or regulation applicable to you;
• you are not a resident, government or government official of any of (each of the following, a “Prohibited Jurisdiction”): (a) a jurisdiction subject to a comprehensive embargo by the British Virgin Islands, El Salvador, the United States, or the United Nations, which comprise as of the date of these Terms, Iran, the Democratic People’s Republic of Korea (“North Korea”), Cuba, Syria, Crimea (a region of Ukraine annexed by the Russian Federation), the self-proclaimed Donetsk People’s Republic (a region of Ukraine), the self-proclaimed Luhansk People’s Republic (a region of Ukraine), Kherson (a region of Ukraine) and Zaporizhzhia (a region of Ukraine), including any government or government official of those jurisdictions; or (b) a high risk jurisdiction subject to a call for action by the FATF to apply countermeasures or enhanced due diligence measures, which comprise as of the date of these Terms, Iran, Myanmar and North Korea;
• you comply with the Responsible Disclosure Policy;
• you comply with all due diligence requirements of Tether as applicable, including related to anti-money laundering and anti-terrorist financing, and successfully pass Tether’s Know Your Customer (“KYC”) requirements, as applicable, according to standards and processes determined in the sole discretion of Tether;
• you are not, and do not use any digital tokens address that is: (a) specifically listed in any Sanctions List (defined below); (b) directly or indirectly owned 50 percent or more by any person or group of persons in the aggregate, or a digital tokens wallet associated with such person or persons, referred to in any Sanctions List, or government or government official of any Prohibited Jurisdiction; or (c) otherwise sanctioned, restricted or penalized under applicable (1) financial sanctions, trade embargoes, export or import controls, anti-boycott, and restrictive trade measures enacted, administered, enforced, or penalized by any laws applicable to either Tether or you, or (2) anti-money laundering and counter-terrorist financing laws (“Sanctions List” means the “Specially Designated Nationals and Blocked Persons” (“SDN”) List and the Non-SDN List, including the “Sectoral Sanctions Identifications List”, published by OFAC; the Section 311 Special Measures for Jurisdictions, Financial Institutions, or International Transactions of Primary Money Laundering Concern published by FinCEN; and, any other foreign terrorist organization or other sanctioned, restricted, or debarred party list published by the FIA, or under Economic Sanctions, AML, or CTF Laws of or by governments of the United States, El Salvador the British Virgin Islands, the United Nations, or any other jurisdiction or government, as applicable to you, Tether, or the Bug Bounty Program, each as amended, supplemented, or substituted from time to time);
• you have not falsified any due diligence, KYC or other application details provided to Tether;
• you are not acting for the benefit of any person who does not meet the requirements set forth herein; and
• you comply with any other eligibility and requirements set out herein

You can speak to our customer support team for any general inquiries on the Bug Bounty Eligibility Requirements.

Rewards Policy:

All Bounty Rewards are priced in $USD and paid in USDt or Bitcoin or any other digital token as determined in Tether’s sole and absolute discretion. We will coordinate any applicable Bounty Rewards over email at the email address you submit to us in your Tether Bounty Report (defined below). In order to provide you with a Bounty Reward, we may ask for your name, contact information, proof of identity and payment information at the time you submit a Bug Bounty Report. Such information is necessary for us to process any Bounty Report and Bounty Reward. We will process this information in accordance with the Privacy Statement for the Bug Bounty Program. Failure to provide us with this information or timely respond to our emails may mean you forfeit any right you may have had to a Bounty Reward.

We are happy to give you recognition for your collaboration but will respect your privacy if you prefer not to reveal your identity publicly. Tether may, at its sole discretion, honour your skills in a future “Hall of Fame,” should one be established, with any bugs appropriate for public disclosure.

Bug examples

We are primarily interested in issues that could lead to theft or loss of funds, unauthorized minting or burning, supply or accounting manipulation, takeover of privileged roles, or a permanent loss of contract integrity or availability.

Examples

• Unauthorized Minting or Burning: Any path to mint or burn outside the authorized minter/owner roles.
• Broken Access Control: Privileged functions (mint, burn, freeze, upgrade, config) callable by unauthorized actors, or vectors to take over an admin/owner role.
• Proxy and Upgrade Flaws: Weaknesses in the upgradeable proxy – storage collisions, unprotected initializers, or unauthorized logic replacement that corrupts state or hijacks the contract.
• Signature and Approval Abuse: Reusing, forging, or replaying a signed approval or transfer permission to move funds the owner never intended to send.
• Balance and Accounting Errors: Arithmetic or logic bugs that desync balances or total supply: value appearing, disappearing, or being double-counted.
• Reentrancy: Re-entering the contract mid-execution to double-spend or leave balances in an inconsistent state.
• Denial of Service: Rendering core operations:  transfers, redemptions, or upgrades permanently unusable.
• Unauthorized Freezing or Locking of Funds: Any path for an unauthorized actor to freeze or lock user funds.

Non-qualifying bug examples

We generally do not provide Bounty Rewards for:

• Automated Scanner Reports: Unverified output from tools like Slither, Mythril, or similar, without a demonstrated exploit path.
• Fully AI-generated reports: Unverified AI generated reports and continuous low-quality or spam submissions may disqualify you from the Bug Bounty Program.
• Theoretical Vulnerabilities: Reports describing a potential flaw with no practical, reproducible exploit or tangible risk to funds, supply integrity, or contract control.
• Best-Practice Findings: Gas-optimization suggestions, missing events or general best-practice recommendations that carry no direct, verifiable security impact.
• Inherent Chain Behavior: Front-running/MEV, transaction-ordering, or block-timestamp effects that are inherent to public blockchains and don’t, on their own, cause loss of funds or bypass a control.
• Unrealistic Preconditions: Attacks requiring majority/51% chain control, unrealistic gas or block-limit assumptions, or economically infeasible scenarios.
• Privileged Actions by Design: Mint, burn, freeze, blocklist, pause, and upgrade performed by their authorized holders are intended behavior, not vulnerabilities.
• Findings Requiring Privileged or Compromised Keys: Attacks that assume the attacker already controls an owner, admin, minter, or other privileged key, or that otherwise depend on leaked/compromised credentials. 
• Sybil or Centralization-Only Reports: Findings whose only claim is Sybil behavior or the existence of centralized/privileged control, without a concrete exploit.
• Destructive or Mainnet-Impacting Testing: Any testing that intentionally or unintentionally degrades service, spams the network, or puts real user funds or live contract state at risk. 

We may still elect to provide Bounty Rewards for borderline cases at our discretion. For example, if the report is unusually high quality or reveals meaningful risk.

How to Send a Tether Bounty Report:

If you find a security vulnerability that meets the above qualifications, please complete the form below (the “Tether Bounty Report”). The Tether Bounty Report must include a short description of the bug, and you must fully complete the form below. You must not share any sensitive data publicly. Each report must follow Tether’s Responsible Disclosure Policy. You understand that you are not guaranteed compensation or credit for your Tether Bounty Report, though Tether may recognize your contribution at its discretion. You may be paid a Bounty Reward for your Tether Bounty Report as determined in our sole discretion. If we receive multiple Tether Bounty Reports for the same issue from different parties, the Bounty Reward will be granted to the first eligible Tether Bounty Report.

If you send an image or a video, please:

• keep it short by showing only the necessary parts;
• recording at a readable resolution;
• make sure the language of the video is in English to help us quickly identify the problem; and
• include a copy of the text in your message explaining what it relates to, if a large amount of text appears in your video.

USA₮ Smart Contracts Bounty Reward Guidelines:

The below table shows the indicative USA₮ Smart Contracts Bounty Reward range paid by bug priority class and risk.


Upon successful verification of the bug discovered we shall advise on the reward amount to be paid out at our discretion. We will assess the bug priority class and risk associated with your reported bug using such criteria as we may determine from time to time at our discretion. We have no obligation to share details of the reasons for our determination or the criteria used.

Risk priority	Minimum Bounty reward	Maximum Bounty reward
RP1	$50,000	$10,000,000*
RP2	$10,000	$50,000
RP3	$500	$10,000
RP4	$100	$500
RP5	$10	$100

* The reward amount is 10% of the funds directly affected, up to a maximum of USD 10,000,000. For the purposes of this program, ‘funds directly affected’ means the value of assets that the reported vulnerability would allow an attacker to steal, transfer without authorization, or otherwise extract from the protocol (including, where applicable, the unauthorized minting of tokens that could be redeemed against backing reserves). The calculation is based on the time and date the bug report is submitted and is determined by Tether in its sole and absolute discretion.

Scope and targets

The products and services listed below are covered by the Bug Bounty Program.

• USA₮ Smart Contracts

This program is intended to expand and change over time. When products or services are added to the Bug Bounty Program, they will be added to the list above or another Tether Bug Bounty Rewards Information Page and Guidelines. Please check back regularly to determine which products are in scope for the Bug Bounty Program.

The above products and services are eligible for bounties for Priority RP1-RP5 depending on the severity of the bug found. Any product or service outside of this list is currently out of scope for the Tether Bug Bounty program.

The scope of the Tether Bug Bounty program does not cover vulnerabilities within third party software including any third-party services integrated with the products and services which are listed above (Note: while third-party services are out of scope, the integrations to third-party services are in-scope). The scope of the Tether Bug Bounty also program does not cover social engineering activities, physical building security breaches, threats involving coercion or extortion and event security risks. If you are aware of illegal activities being planned you should make our team aware and contact your local authorities.

If you believe you have discovered a vulnerability that should be included in the Bug Bounty Program please complete our Tether Bounty Report below.

You must not make your findings public, you should notify the official team members you have found a vulnerability and we will advise how to provide more detailed information securely.

Tether retains ultimate discretion regarding providing Bounty Rewards, including potentially in respect of otherwise out of scope products, services or bugs. Any such Bug Bounty Rewards will be deemed to fall within the Bug Bounty Program.