Stormrake is an Australian crypto trading platform with a bug bounty ranging from AUD $50 to AUD $5,000. Crypto platforms are among the most scrutinized targets on the internet — and simultaneously among the most rewarding, because a vulnerability on an exchange touches user funds directly.
Program Overview
| Detail | Value |
|---|---|
| Reward range | AUD $50 – $5,000 |
| Policy | stormrake.com/offering/stormrake-bug-bounty-program |
| Submission | Email: security@stormrake.com |
| Type | Direct company program |
Note the currency: rewards are denominated in Australian dollars, and the policy page defines how severity maps to payout. Crypto-native programs sometimes pay in tokens — check the policy for the payment method before setting expectations.
Attack Surface: Where a Trading Platform Breaks
Exchanges and trading platforms concentrate three valuable assets in one place: money, identities, and transaction history. The standard high-value classes:
- Order and trading logic. Negative quantities, self-trade manipulation, price-format edge cases, and race conditions between order placement and balance checks. Trading engines have state machines, and state machines have seams.
- Balances and withdrawals. The single most valuable test target: does every withdrawal path correctly re-validate the balance server-side? Client-side balance checks, decimal/rounding mismatches, or withdrawal requests replayed twice are critical-severity by definition. Test only with your own funds and accounts.
- KYC and account boundaries. Identity documents and personal data live here. Cross-account access to another user’s verification data is a critical privacy breach — always test between two accounts you own.
- Authentication and sessions. Login, 2FA flows, password reset, and session invalidation after sensitive actions. A password reset that doesn’t invalidate active sessions, or 2FA that can be bypassed via parameter tampering, sits near the top of the ladder.
- API and dashboard. Rate-limit enforcement on sensitive endpoints, IDOR on order/history objects, and authorization on account settings. Standard Web2 checks, elevated severity because money is involved.
Beginner Mistakes to Avoid
1. Testing with real trades on live markets. Everything runs on test accounts or minimal-impact orders you immediately cancel. Any activity that could move a market price or affect another user’s order is out of bounds — on a trading platform, “harmless testing” doesn’t exist.
2. Probing withdrawal flows with real funds at volume. Demonstrate the logic flaw once, with the smallest possible amount, on your own account. Never attempt an actual exploit path that could move someone else’s funds — that’s theft with extra steps, regardless of intent.
3. Assuming crypto bug bounty = smart contract audit. This program covers the Web2 surface: the website, APIs, and dashboard. You don’t need Solidity skills; you need sharp authorization testing and API logic analysis.
4. Reporting rate limiting or missing headers as critical. Financial platforms triage strictly. Overstated impact on a money-handling platform reads as either incompetence or a social engineering attempt. Neither gets paid.
5. Ignoring jurisdiction and KYC. Australian companies comply with Australian financial regulations, which may require researcher verification for payouts and restrict who can participate. Read those terms before investing hours.
Why Money-Adjacent Platforms Pay More Per Bug
Severity is priced by damage. The identical IDOR pays $200 on a recipe site and $5,000 where the object is an order or a balance. If your testing methodology is solid — accounts you own, clean PoCs, server-side logic focus — directing it at trading and fintech platforms is the highest-leverage choice in Web2 hunting. The trade-off is stricter triage and stricter rules, which is exactly why careless hunters avoid them.
Next Step
Stormrake is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, contacts, and policy links in CSV/JSON. Filter by payout, pick a target, hunt the same day.