ME
HackerOneOffers Rewards
Magic Eden
Magic Eden appears to run a bug bounty or vulnerability disclosure program on HackerOne. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (2)
api.dicey.com ( Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.
Strictly Out of Scope:
No Social Engineering.
No Non-Production Assets: Testing is limited to production only; ignore test/dev environments.
No DoS/DDoS: Do not attempt to disrupt our services.
Reports failing to follow these guidelines will be disqualified from rewards. )
dicey.com ( Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.
Strictly Out of Scope:
No Social Engineering.
No Non-Production Assets: Testing is limited to production only; ignore test/dev environments.
No DoS/DDoS: Do not attempt to disrupt our services.
Reports failing to follow these guidelines will be disqualified from rewards. )
Out of Scope (15)
*.magiceden.dev ( Cryptocurrency = Solana.
Only reports detailing High or Critical severity issues will be reviewed for potential rewards )
*.magiceden.io ( Only reports detailing High or Critical severity issues will be reviewed for potential rewards )
*.magiceden.workers.dev
blog.magiceden.io ( This service is done through substack and they are unwilling to fix reported bugs )
cdn.magiceden.dev
docs.magiceden.io
eng.magiceden.dev
eng.magiceden.io
help.dicey.com
http://auth.magiceden.io
http://ord-mirror.magiceden.dev
img-cdn.magiceden.dev
magiceden.io ( Program Focus:
We are only accepting High and Critical severity reports.
Reports must be specifically related to Solana protocols or NFT-integrated functionality )
mainframe.magiceden.io
staging.dicey.com