Blazecoin (BLZ) bug bounty: paid in BLZ for confirmed bugs in the node, the wallets and the websiteBlazecoin is a scrypt proof-of-work coin mined continuously since 23 May 2014. In September 2026 it activated a post-quantum output type (ML-DSA-44 (NIST FIPS 204)) at block 4,250,000. All of the software is open source. We would rather pay you to find our mistakes than find out about them the hard way, so this is a standing bounty, not a campaign.
In scopeOut of scope- Anything that needs a denial-of-service attack, flooding, or spam against the live site, the pool or the public nodes. Test against your own node.
- Social engineering, phishing, or anything involving other people's accounts.
- Reports from automated scanners with no working proof, duplicates of a known issue, and issues in third-party sites.
- Theoretical weaknesses with no demonstrated effect.
Rewards (paid in BLZ, per confirmed bug, first reporter only)- Critical: 5,000 BLZ. A consensus split, forging or bypassing signatures (classic or post-quantum), spending coins you do not own, or crashing other people's nodes remotely.
- High: 1,000 BLZ. Exposure of wallet keys or seed phrases, bypassing the website's login or two-factor checks, or taking rewards from the earn system you are not owed.
- Medium: 250 BLZ. Bugs that need unusual conditions or user interaction but have a real effect.
- Low: 50 BLZ. Minor issues with a clear fix.
Severity is decided by us after reproducing the report, with a short explanation either way. Rewards are paid to a Blazecoin address of your choice once the fix is released. These are participation rewards for helping the project, not an income.
How to report- Email admin@blazecoin.co.uk with "bug bounty" in the subject. Do not post the details in this thread or anywhere public until the fix is out; a public disclosure before that forfeits the reward.
- Include: which software and version, the steps to reproduce, what you expected and what happened, and (where it applies) a transaction or block on a test setup.
- We acknowledge within 3 days and give a verdict within 14. If we are slow, nudge us here in the thread without the details.
Rules- One reward per bug; if two people report the same thing, the first email wins.
- Keep the testing to your own node, wallet and accounts.
- Team members and their households are not eligible.
- We may change the amounts for new reports; a reward already agreed is not reduced.
Questions about the scope are welcome in this thread. The announcement thread, with the full history, is
https://bitcointalk.org/index.php?topic=5597142.0.
Crypto-assets are volatile and largely unregulated; their value can fall to zero. Nothing here is financial or investment advice.
This is not directed at persons in the United Kingdom or the European Economic Area.
