Veilo delivers native Solana privacy, enabling instant shielded transfers via simple usernames without any slow bridges.
View VeiloLayer’s pageVeilo Layer is an all-in-one privacy app for Solana that lets users send, swap, trade, buy and sell memecoins, access perps, use prediction markets, buy tokenized stocks, bridge assets, and interact with supported dApps privately through a wallet and browser extension.
Find critical vulnerabilities in Veilo’s mainnet smart contracts that could directly lead to user fund loss.
We are looking for verifiable vulnerabilities that could cause:
Loss of user funds
Unauthorized withdrawals
Theft of user funds
Unauthorized movement of funds from Veilo contracts
Critical logic, accounting, access control, or withdrawal bugs that could allow funds to be extracted
Mainnet Rules:
Mainnet contracts may be reviewed, analyzed, and tested safely.
Do not exploit mainnet, move real funds, attack users, manipulate balances, or put live funds at risk.
Valid proof can be shown through:
Mainnet contract analysis
Read-only calls
Transaction simulation
Local fork testing using mainnet state
Clear reproducible proof-of-concept
This bounty applies exclusively to Veilo’s deployed onchain Solana program and does not cover the website, browser extension, wallet interface, backend services, APIs, infrastructure, or other offchain components.
Out of Scope:
UI-only bugs
Gas optimization
Theoretical issues without proof
Social engineering or phishing
DoS issues without fund loss
Duplicate or already known issues
Reports that require harming users or moving live funds
Submissions must include:
Affected mainnet contract or function
Clear explanation of the issue
How it leads to fund loss
Reproducible proof or simulation
Suggested fix
Confirmation that no live funds were moved or put at risk
Submissions must be in English.
Submit the report directly through the Superteam bounty submission page.
The submission should contain the complete technical report, proof-of-concept, simulation results, affected program instructions or functions, reproduction steps, impact assessment, and recommended remediation.
Any supporting files, scripts, transaction simulations, screenshots, videos, or private repositories must be accessible to the Veilo team for review.
Do not publish or publicly disclose any discovered vulnerability before Veilo has reviewed and resolved the issue.
The winning submission will be awarded for the most:
Valid vulnerability
Reproducible vulnerability
High-impact vulnerability
Vulnerability that shows a realistic path to loss of funds from Veilo’s mainnet contracts
Clarity and completeness of the explanation
Quality of the suggested fix
Mainnet Program — Veilo / privacy_pool: GYy4kM6GHhpgLCUscuABbzkD2ZbJ2fneYryaZ6Ch7fFU
Solscan: solscan.io
Solana Explorer: explorer.solana.com
Application / Website: veilo.network
Product Documentation: docs.veilo.network
Source Repository: github.com
1st Place: 2,000 USDC
Veilo delivers native Solana privacy, enabling instant shielded transfers via simple usernames without any slow bridges.
View VeiloLayer’s page