HackerOneOffers Rewards

Metamask

Metamask appears to run a bug bounty or vulnerability disclosure program on HackerOne. It also offers rewards for valid security reports.

Created: February 15, 2026

Last Updated: October 5, 2026

Visit Program Page

In Scope (13)

MetaMask Browser Extension ( [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as an extension on chromium-based and firefox browsers. )

MetaMask SDK ( The MetaMask SDK allows for third party developers to remotely connect with their user's MetaMask wallets after performing an authorization flow. )

Snaps ( Snaps is a feature that allows third party developers to add new functionality to MetaMask. A snap is a JavaScript program that runs in an isolated environment and customizes the wallet experience. Snaps have access to a limited set of capabilities, determined by the [permissions](https://docs.metamask.io/snaps/how-to/request-permissions/) the user granted them during installation. Visit our [quickstart guide](https://docs.metamask.io/snaps/get-started/quickstart/) to learn how to build your own snap, or visit [snaps.metamask.io](http://snaps.metamask.io) to see the possibilities that snaps now offer. Please note that for the duration of the open beta, custom made snaps can only be installed on experimental [MetaMask Flask](https://metamask.io/flask/). While that asset is out of scope, vulnerabilities concerning the snaps feature are eligible for submission if they affect the main extension as well. **Supporting Documentation:** - https://github.com/MetaMask/snaps/tree/mai

Third Party Snaps ( Vulnerabilities found in third party snaps should always reported to the developer responsible for the snap. However, in cases where a developer is unable to be reached, please report the vulnerability here so that we may assist with getting in contact. These kinds of reports will be closed as informative, and will not be eligible for a bounty. )

api-wallet.web3auth.io ( API used by Web3Auth Wallet Services )

https://metamask.github.io/phishing-warning/<vX.Y.Z> ( The phishing warning page is a security control that warns users when they attempt to visit a webpage found on one of our known phishing blocklists. Only vulnerabilities found on the latest version are eligible for a bounty. Supporting Documentation: * https://github.com/MetaMask/phishing-warning/releases * [Code usage in MetaMask extension](https://github.com/MetaMask/metamask-extension/blob/d96c2b8530ff0fe66ad8977641bc70cc0b58cc03/app/scripts/contentscript.js#L611-L624) )

io.metamask ( [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as a mobile application on iOS and Android. )

io.metamask.Metamask ( [MetaMask](https://metamask.io/download) is everything you need to manage your identity, digital assets and to explore web3. Available as a mobile application on iOS and Android. )

mUSD Stablecoin ( **This asset is owned and maintained by the m0 team. All reports should be directed to [email protected] and are subject to the m0 team’s assessment when determining if a report may be eligible for a bounty.** If you do not receive a response within 1 week, please submit a report to us as well and we will assist you with getting in contact with m0. **Introduction** The mUSD token is built upon the M0 framework, which leverages real-world assets (RWA) to mint a rebasing M token on-chain, with subsequent yield from RWAs distributed through M token rebasing mechanisms. The M0 framework wraps the rebasing M token into non-rebasing MExtension tokens that feature customizable configurations for yield distribution. The mUSD token represents one such implementation, utilizing the MYieldToOne extension to direct yield to a designated recipient. The broader M0 framework and MExtension system architecture is outside the audit scope, and the focus is specifically on the mUSD tok

metamask.io ( The root https://metamask.io webpage and the metamask.io DNS configuration. )

signature-insights.api.cx.metamask.io ( The Signature Insights API receives off-chain signature requests (eth_signTypedData_v3, eth_signTypedData_v4, etc.) from MetaMask Extension & Mobile and decodes them into state changes to be rendered into human readable balance changes. These balance changes are shown in the confirmations windows when a user is signing an off-chain signature request for popular dapps such as OpenSea, Uniswap, and others. API docs: https://metamask-consensys.notion.site/Public-MetaMask-Signature-Insights-API-Documentation-189f86d67d688047851fed6656a3199a )

snaps.metamask.io ( This is a directory that lists featured snaps available for installation on MetaMask. **Supporting Documentation** - https://github.com/MetaMask/snaps-directory )

wallet.web3auth.io ( Web3Auth Wallet Services provide both a stand-alone wallet app, known as Torus Wallet, and a ready-to-use embedded wallet interface available directly within the Web3Auth SDK. )

Out of Scope (22)

*.api.cx.metamask.io ( APIs used by MetaMask wallet and Portfolio )

Core Tier Assets ( MetaMask's Core Tier Assets are specific MetaMask assets which are paid out in accordance with our Core Tier bounty table. This table can be found on our program page, and includes the following assets: * MetaMask SDK * metamask.io * `https://metamask.github.io/phishing-warning/<vX.Y.Z>` * `https://signature-insights.api.cx.metamask.io` * Web3Auth Wallet Services and Its API )

Message signing snap ( This snap is pre-installed on MetaMask and can be tested via RPC calls. - **Main documentation**: https://github.com/MetaMask/message-signing-snap/blob/main/docs/testing.md - **Testing video tutorial**: https://www.loom.com/share/93ce2929c2584cf89af87d76f61be978 )

Metamask Flask Extension ( Installation Link: https://chrome.google.com/webstore/detail/metamask-flask-developmen/ljfoeinjpaedjfecbmggjgodbgkmjkjk This is an experimental playground for developers, where new or proposed features can be rolled out and tested before deploying them to the broader public. )

Non-Core Tier Assets ( MetaMask's Non-Core Tier Assets are specific MetaMask assets which are paid out in accordance with our Non-Core Tier bounty table. This table can be found on our program page, and includes the following assets: * https://snaps.metamask.io )

Snaps Development Packages ( The Snaps development tools consist of a series of unrelated packages that can assist in the development of a snap. These tools are eligible for a bounty in cases where a victim can be impacted by exploiting one of the following tools (ex: achieving remote code execution by having a developer build your snap with snaps-cli). These tools are as follows: - [create-snap](https://github.com/MetaMask/snaps/tree/main/packages/create-snap) - [snaps-browserify-plugin](https://github.com/MetaMask/snaps/tree/main/packages/snaps-browserify-plugin) - [snaps-cli](https://github.com/MetaMask/snaps/tree/main/packages/snaps-cli) - [snaps-rollup-plugin](https://github.com/MetaMask/snaps/tree/main/packages/snaps-rollup-plugin) - [snaps-simulator](https://github.com/MetaMask/snaps/tree/main/packages/snaps-simulator) - [snaps-webpack-plugins](https://github.com/MetaMask/snaps/tree/main/packages/snaps-webpack-plugins) )

Wallet Tier Assets * MetaMask Snaps )

api-dashboard.web3auth.io ( API used by the The Web3Auth Dashboard )

card.metamask.io ( All content is entirely owned, operated, and managed by Baanx. For any vulnerabilities related this domain, or any of its subdomains, please send an email to the following email address: [email protected]. Please also CC: [email protected]. If you do not receive a response within 1 week, please submit a report to us as well and we will assist you with getting in contact with Baanx. )

community.metamask.io ( Vulnerability reports related to this domain should be directed to the Discourse bug bounty program: https://hackerone.com/discourse )

dashboard.web3auth.io ( The Web3Auth Dashboard is a centralized platform to manage your projects, configurations, and wallet integrations for MetaMask Embedded Wallets )

developer.metamask.io ( MetaMask Developer provides instant and scalable API access for web3 dapp developers. Bounty Tier: Core )

https://*.metamask.io

https://github.com/Web3Auth/web3auth-web ( MetaMask Embedded Wallets (Web3Auth SDK) is a pluggable embedded wallet infrastructure that simplifies Web3 wallet integration and user onboarding )

https://metamask.github.io/ ( This domain is the root of various static GitHub pages applications which range from test sites, to development tools, to production security controls. Vulnerabilities which can be used to have impact on an in-scope asset will still be considered for a bounty. )

https://mmi-support.metamask.io/

https://support.metamask.io/

https://user-storage.api.cx.metamask.io ( The User Storage API helps developers synchronize data across multiple clients and devices in a privacy-preserving way. All data saved in the user storage database is encrypted client-side to preserve privacy. Documentation can be found in this [Doc](https://docs.google.com/document/u/1/d/e/2PACX-1vRzlbxKTKQ4x8mvUEUs8hv-fcGsi0W717Pbg2_Rk3lcoM5PuSCI66JUWaWdL_Vz0GNMbZU4aYaC2rcQ/pub) )

https://www.npmjs.com/search?q=%40metamask ( Vulnerabilities within npm packages in the @metamask namespace that do not pose a risk to MetaMask users )

permissionless.snaps.metamask.io ( An experimental directory for permissionless snaps. Is currently under development, and may potentially be put in scope in the future. )

portfolio.metamask.io (app.metamask.io) ( The Portfolio dApp allows Metamask users to see an aggregated view across multiple different Metamask accounts. It also allows users to access popular on-chain primitives like Swaps, Bridging, Staking, and more. )

travel.metamask.io ( All content is entirely owned, operated, and managed by entravel.com. For any vulnerabilities related this domain, or any of its subdomains, please send an email to [email protected]. If you do not receive a response within 1 week, please submit a report to us as well and we will assist you with getting in contact with them. )