Reporting Vulnerabilities

The Base procedures for reporting vulnerabilities.

Bug bounty program

In line with our strategy of being the safest way for users to access crypto:

• Coinbase extended our best-in-industry million-dollar HackerOne bug bounty program to cover the Base network and Base infrastructure.
• Coinbase has launched a 5 million-dollar Cantina bug bounty program to cover all deployed smart contracts for Base, and those used as part of Coinbase products and services.

Reporting vulnerabilities

Submit potential vulnerability reports via the appropriate platform below:

1. HackerOne — For offchain components and services. All reports are triaged around the clock by Coinbase engineers with domain knowledge. For more information, view our security program policies.

2. Cantina — For deployed smart contracts. For more information on what smart contracts are within scope, view the Tier 0 and Tier 1 scope guides.

For all other security-related inquiries, contact [e-mail].