Security program

Help us secure
on-chain markets.

Report a vulnerability privately to the Phoenix security team. Valid submissions become draft GitHub Security Advisories for confidential triage.

Private by default Researcher attributed On-chain anti-spam

Researcher identity

Sign in before you begin

GitHub authentication prevents impersonation and ensures the advisory is credited to the right researcher.

Continue with GitHub

Program agreement

Before you report

Loading program terms…

I have read and agree to the Phoenix Bug Bounty Program Terms.

Vulnerability report

Tell us what you found

Target repository * Summary * GitHub may include this title in notification emails. Keep it high-level. Vulnerability description * Steps to reproduce * Impact * Evidence links Links only. Do not upload files to this portal.

Severity *

Critical High Medium Low

Use the Immunefi-style impact tiers described in the program terms.

On-chain submission gate

Burn — USDC

Permanent and non-refundable.

Only run the burn once. A burn cannot be reversed or refunded, including for duplicate, invalid, or out-of-scope reports.

Solana wallet address *

USDC mintLoading…

Unique memoLoading…

Burn with the standalone SPL Token CLI

Use the standalone SPL Token CLI for these commands. Use a keypair for the wallet address entered above, with enough SOL to pay transaction fees. Never enter a private key on this site.

Find a USDC token account owned by that wallet. A token account address is different from a wallet address. Select only an account returned by this mint-filtered lookup. If several are listed, choose one with enough USDC, then check its mint, owner, and balance with spl-token --url mainnet-beta display USDC_TOKEN_ACCOUNT_ADDRESS.

Loading…

Replace WALLET_KEYPAIR_PATH with the full path to your keypair and USDC_TOKEN_ACCOUNT_ADDRESS with the account you inspected. Confirm the signer matches the wallet above, the displayed token account mint and owner match the portal, and the amount and unique memo are exact. The CLI burns the mint held by the supplied account; it does not check that mint against this page. It includes the burn and memo in one transaction. Burning is permanent.

Loading…

Waiting for a matching transaction.

Private disclosure

Ready to submit?

Your report will be sent privately to the Phoenix security team as a draft GitHub Security Advisory.