Member Login

Bug bounty

Find a flaw in the Digital World Network. We will pay you for it.

The Digital World bug bounty rewards security researchers who responsibly report vulnerabilities in the network, its gateway, its SDKs and the LIFE apps that members use to hold their identity and money.

Report a vulnerability See what is in scope

Rewards by severity

We rate every valid report with CVSS 4.0 and its real impact on member funds, keys and data. The reward follows the severity we confirm.

Critical

Up to $50,000

From $15,000

  • Theft, minting or freezing of assets without authorization
  • Consensus failure, chain halt or double spend
  • Bypass of issuer authorization or clawback controls
  • Extraction of member private keys

High

Up to $10,000

From $3,000

  • Temporary loss of access to funds
  • Transaction signing manipulation in an SDK
  • Account takeover in a LIFE app
  • Exposure of vault records or credentials

Medium

Up to $2,500

From $750

  • Gateway responses that report false balances or supply
  • Stored cross-site scripting in member-facing apps
  • Authorization flaws with limited data exposure

Low

Up to $500

From $100

  • Information disclosure without member data
  • Security misconfiguration with a demonstrated impact

Rewards are paid in NATIVE, the base asset of Digital World, at the US dollar value of the reward on the payout date, after the fix is deployed. Liquidity for NATIVE is not guaranteed, and its value may fluctuate from time to time. The first valid report of an issue receives the reward. Duplicate reports are acknowledged but not paid.

Scope

Test only the systems listed as in scope. If you are unsure whether something qualifies, ask us before you test.

In scope

  • Digital World Network node software and consensus
  • Public gateway at dex.digitalworld.global
  • Network explorer at explorer.digitalworld.global
  • JavaScript SDK (@digitalworld/digital-world) and Python SDK
  • Market API at sdk.digitalworld.market/api
  • Smart contracts deployed by Digital World on the network
  • Clear LIFE app for Android and Life Online at portal.clear.software

Out of scope

  • Denial of service, load testing or spam
  • Social engineering, phishing or physical attacks
  • Websites and services run by third parties or regional partners
  • Bugs in upstream open-source software that do not affect Digital World; report those to the upstream project
  • Missing security headers, rate limits or best practices without a demonstrated impact
  • Findings that require a rooted device or physical access to a member’s phone

What happens after you report

You hear from a person, not an autoresponder, and you can track your report at every step.

  1. You report

    Send the details and steps to reproduce.

  2. We acknowledge

    Within 2 business days.

  3. We triage

    Severity decision within 5 business days.

  4. We fix and pay

    Critical fixes target 30 days. Reward paid on deployment.

  5. We disclose together

    Public write-up, with credit if you want it, within 90 days.

Rules of engagement

Follow these rules and your research stays protected under our safe harbor.

  • Use test accounts and test assets you control. Never access, move or modify another member’s funds or data.
  • Stop and report as soon as you confirm a vulnerability. Do not escalate further than needed to show impact.
  • If you reach member data by accident, stop, report it and delete what you hold.
  • Do not degrade the network or the gateway for other members.
  • Keep the issue confidential until we disclose it together.
  • One vulnerability per report, with clear steps to reproduce.

Who can receive a reward

Anyone may report a vulnerability, and we welcome every report. Rewards are paid only to researchers who are independent of Digital World and the companies that build and run it.

Not eligible for rewards

  • Current employees, contractors, officers, directors and advisors of the ClearCompanies, ClearSoftware, or any Digital World Service Provider or Authorized Digital World Partner, and anyone who held such a role in the past 12 months.
  • Immediate family and household members of anyone listed above.
  • Anyone with access to non-public Digital World source code, infrastructure, credentials or internal systems, including through a contract, audit or partnership.
  • Firms and individuals engaged to audit, test or monitor Digital World, for findings within that engagement.
  • Anyone on a US sanctions list, in a sanctioned jurisdiction, or barred by law from receiving the reward.
  • Anyone under 18, or under the age of majority where they live, unless a parent or guardian consents.
  • Government employees whose employer does not allow them to accept the reward.

To receive a reward, you agree that

  • You will verify your identity through the Life App before payout, and you are responsible for any taxes on the reward.
  • A report loses eligibility if it was disclosed publicly before a fix, used to demand payment, or found by breaking these rules.
  • Each issue is rewarded once, to the first valid report. Reward amounts are decided by ClearSoftware, and the program may change or end at any time, without affecting reports already accepted.

Safe harbor

If you act in good faith and follow these rules, we will consider your research authorized. We will not pursue or support legal action against you for it, and we will not ask law enforcement to act against you.

If a third party brings legal action against you for research that followed these rules, we will make it known that your work was authorized under this program.

Questions

Anything not answered here, ask us through Secure Communication in the Life App, at security@digitalworld.earth or at 801.851.5555.

Can I test on the live network?

Yes, with accounts and assets you create yourself. Do not interact with accounts you do not control, and do not run tests that slow the network for others.

Does the program cover FRNT?

It covers how the Digital World Network, gateway and apps handle FRNT and every other asset. Issuance and redemption of FRNT are controlled by the Wyoming Stable Token Commission and its providers; report issues in their systems to them.

How do you decide severity?

We start from a CVSS 4.0 score, then weigh the real impact on member funds, keys and data. We explain our decision and you can respond before it is final.

Will you credit me publicly?

Yes, if you want to be credited. You choose the name we use, or you can stay anonymous.

How is the program funded?

ClearSoftware LLC, an Authorized Digital World Partner, funds all rewards. Payouts do not depend on any third-party platform.

Report a vulnerability

Reach the security team through Secure Communication in the Life App, or email us and encrypt sensitive details with our PGP key if you can. Include:

  • The affected system and version
  • Steps to reproduce, with any proof of concept
  • The impact you observed
  • How you would like to be credited
Email security team View security.txt

Or call 801.851.5555

Bug bounty program operated by ClearSoftware LLC. Last updated October 2026.