Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:helixpay ×
  • criticalPGN-10468

    Issuing API lets a sandbox key approve authorizations on a live card program it does not own

    Authorization-decision webhooks were matched by card-program id without checking the key's environment. Two researcher programs were used; no third-party funds moved.

    Helixpay@rookImproper Authorization24 Oct 2026triage 12hresolved 7.2d
    $60,000
    Resolved
  • criticalPGN-10349

    HelixVault withdraw path skips share recomputation after emergency pause lift

    Reproduced on a mainnet fork with a Foundry test; the top of the critical band was paid without negotiation.

    Helixpay@glasswingIncorrect Calculation15 Sept 2026triage 5.5hresolved 6.9d
    $75,000
    Resolved
Hacktivity
Connecting
  • Bounty paidHelixpay@rook
    Issuing API lets a sandbox key approve authorizations on a live card program it does not own
    critical
    $60k
  • Bounty paidHelixpay@glasswing
    HelixVault withdraw path skips share recomputation after emergency pause lift
    critical
    $75k
All disclosed reports →