Hello Hunters,
Today's update sharpens the rules around one target and puts one of our most critical surfaces in the spotlight.
First, the housekeeping
github.com/uphold/* stays in scope, but with a tighter focus. Most reports we see there carry little signal and describe risks too hypothetical to act on. Going forward, we only want findings that reach our systems or can impact the repository itself: leaked secrets, compromised pipelines, and the like. Everything else will be considered out of scope.
Your Uphold Bug Bounty Program Feedback Form answers keep telling us the same thing: you want targets where the impact lives. So we pointed the spotlight at one that pays: the Uphold Enterprise APIs.
What the Enterprise APIs are
The Enterprise API Suite is our B2B backbone: it lets our enterprise portal partners onboard users and move value across banks, cards, and crypto, with Uphold sitting underneath, invisible to the end user.
Concrete picture: a fintech wants to let its users buy and sell crypto without building an exchange. They integrate the Enterprise APIs, onboard their users through them, and move funds across card, bank, and crypto rails from their own backend.
It is three surfaces in one suite:
- Direct REST APIs for buying, selling, exchanging, or transferring stablecoins and crypto straight from your backend.
- Drop in Widgets for payments, KYC, and compliance.
Start here: https://developer.uphold.com/get-started/overview
Your setup path, in five steps
- Register your organization at https://portal.enterprise.uphold.com and select Enterprise APIs as the product use case.
- Sandbox is immediate: fully isolated, mirrors production behavior, test funds and data. No manual invite, no waiting.
- In the portal sidebar, open Clients and click Create new client. Give it a name and select the scopes it needs.
- Generate your Client ID and Client Secret.
- Fork the public Postman workspace, set your credentials, and fire the Authentication token request. The collection chains everything after that: user, quote, and transaction IDs are captured and reused automatically, so you can run a full flow end to end.
Full setup guide: https://developer.uphold.com/get-started/set-up-your-account
Postman workspace: https://www.postman.com/uphold/enterprise-api/overview
Your first API call: https://developer.uphold.com/get-started/make-your-first-api-call
Where the interesting findings live
The Enterprise APIs are a B2B authorization playground: organizations, multiple API clients per organization, scopes per client, and money moving across all of it. That is where we expect the real bugs:
- Scope enforcement: can a client do more than its scopes allow?
- Access across organizations and clients: IDOR between orgs, clients, users, accounts, and transactions.
- The full lifecycle: create a user, create a quote, execute a transaction, and try to bend each step.
And the advice from the last update applies double here: register multiple accounts and multiple clients. One organization sees nothing. Two see the gaps between them.
Keep the answers coming
This update is your feedback at work, again. These changes came straight from the loop: you told us where the program was wasting your time, so we tightened the rules where the signal was low and pointed you at a target that pays. That is the deal, and it only works if you keep answering.
So tell us where you got stuck, where you gave up, and what we should fix. If a limitation blocked you mid test, or a wall did not hold, we want to hear it. Two minutes of your time in the Uphold Bug Bounty Program Feedback form. For anything else, we are directly reachable at security@uphold.com.
And a reminder while you are at it: the 50% bonus window is open until 27 Nov for every High, Critical and Exceptional report on Tier 1 and Tier 2 targets.
Happy hunting,
Uphold Security Team
Hello Hunters,
Today's update is about Topper, Uphold's embeddable crypto on-ramp and off-ramp. It is fully included in our Tier 1 and Tier 2 targets, and it sees less testing than it deserves, mostly because it is two products connected by one flow and hunters tend to see only one side. This update fixes that. And it is your feedback at work: product context was a top request in the form, so this is the first of a series.
What Topper is
Topper is a widget. A partner embeds it in their own web or mobile app, and their users buy or sell crypto without ever leaving the partner's product.
ON-RAMP (buy) card or payment method --> crypto to the destination wallet
OFF-RAMP (sell) crypto from the wallet --> fiat payout to card or bank account
Concrete picture: an online store embeds Topper in its checkout. A customer buys a jacket, pays by card inside the widget, and Topper converts the payment to crypto in real time. The store receives the crypto in its merchant wallet. The customer never sees an exchange.
Two apps, one flow
The top of the flow is the Enterprise Portal, the B2B control center. Register, select Checkout Integration (Topper) as the product use case, and your organization is created for you. From there you create the widget and walk away with two values: the Widget ID and the Public Key ID.
One thing the portal does not do: widget parameters. Fees, redirect URLs, target, none of them live there. They live in the Bootstrap Token your backend builds, as described in the Topper Widget Documentation, with the full parameter lists for the crypto on-ramp and crypto off-ramp flows.
The bottom of the flow is the widget itself, the B2C experience. When a user is ready to buy or sell, your backend generates a signed session from the Bootstrap Token, the widget loads with those parameters, and the user takes over: self-registration, identity verification, order execution.
Your setup path, in four steps:
- Create an account in the Enterprise Portal and select Checkout Integration (Topper)
- Create the widget and save the Widget ID and Public Key ID
- Build the Bootstrap Token with your parameters: fees, redirect URLs, target
- Generate the signed session, load the widget, and run the flow as an end-user
Testing without blockers
Sandbox gives you an automatic identity verification bypass and test cards with specific outcomes, both described in the environments documentation.
Two guardrails to know upfront. Create end-user accounts in USA, New Jersey to stay clear of jurisdiction restrictions. And in the off-ramp flow, only debit cards matching the user's country of residence are accepted.
Set up your own partner configuration, then run the flows as an end-user. That is where the interesting findings live: how data and logic travel between your backend, the signed session, and the widget.
Keep the answers coming
This update is your feedback at work. Clearer product context was one of the top answers in the feedback form, so we built it. That is the loop: the form is how we measure what is wrong in the program and adjust it, and what we publish next is steered the same way.
So tell us where you got stuck, where you gave up, and what we should fix. If a limitation blocked you mid-test, or a wall did not hold, we want to hear it. Two minutes of your time. For anything else, we are directly reachable at security@uphold.com.
And the 50% bonus window is open until 27 Nov for every High, Critical and Exceptional report on Tier 1 and Tier 2 targets. Topper is fully in it.
Happy hunting,
Uphold Security Team
From 28 Sep to 27 Nov, every High, Critical and Exceptional report on Tier 1 and Tier 2 targets pays +50%.
This window rewards one thing: severity where it matters. Below is how we suggest you get there, and how your feedback will shape what comes next.
How we suggest you hunt
- Start with the documentation. Most duplicates and out of scope reports come from skipping it, and ten minutes of reading saves everyone days.
- From there, make sure the scope is clear. The path to logic bugs starts with knowing what is in scope and how each target is supposed to behave. If anything is unclear, ask before you hunt.
- With the scope clear, build the picture before you test. Map the attack surface. Know what each product is, and where the line runs between B2C and B2B. Bugs hide in business logic, and business logic only makes sense once you know what each product does and how the flows connect.
- Two accelerators on the way. Our documentation works well as context for AI agents: it is the fastest route to productive testing and to resuming where you left off. And credentials are not a limitation: request multiple accounts, because cross account scenarios are where our real bugs live, from IDOR to authorization between roles. One profile sees nothing. Three do.
- A note on expectations: you do not need web3 expertise for this program. Most of our surface is standard web2: APIs, dashboards, session handling, access control. Researchers who test banks can test us.
- One boundary. Use AI to build context and understand the app, and use the program with judgement. Do not spam reports hoping something sticks: the platform limits how many reports you can have open, so spend them on findings you believe in. Automated, copy pasted submissions are classified as spam.
Two constraints we can manage for you
- Country limitations are real, by design, and worth testing: registration and some features are restricted by regulation. If a limitation blocked you during testing, tell us in the form. If a wall did not hold, we want to hear about it.
- If you are stuck at IDV: once you have completed identity verification, reach out and we will skip the step on your account, so you move faster through the remaining flows.
What is coming, and how your answers steer it
Over the next two months we are publishing updates on a regular cadence: fresh hints per product, boosted bonuses on High, Critical and Exceptional, and digested information built from your answers to the form (Uphold - Bug Bounty Program Feedback).
The loop is direct. Your answers guide what we prioritize next: which blockers to attack, which context to build, which products deserve a closer look. Nothing is read and archived.
So tell us where you got stuck, where you gave up and what we should fix. Two minutes of your time.
Uphold Security Team
Hello Researchers,
We appreciate the high level of engagement with the Topper component. However, we have observed a significant volume of automated traffic and high-frequency scanning hitting Topper in our production environment.
If you are currently running automation against Topper in Production, please stop immediately. We provide a dedicated sandbox environment precisely for this type of research. It allows you to test Topper’s limits and run automated scripts without impacting live services or real users. Moving forward, reports resulting from production automation may be marked as Out of Scope.
Please direct all automated testing to our sandbox:
Thank you for your cooperation in keeping our production environment stable.
Regards,
Uphold Security Team
Hunters!
We are providing this update to clarify the current process for accessing our sandbox environments to ensure you can get started with your testing as quickly as possible.
Enterprise Portal (Self-Signup)
Self-registration is now fully a*vailable for all researchers. You can instantly create sandbox environments to explore and test Enterprise APIs, no manual invite or sales contact required.
Instant Access: Register directly at portal.enterprise.uphold.com.
Sandbox Wallet Access Flow
For testing on the wallet environment, please follow this specific flow to prepare your accounts for authorization testing:
- Registration: Create your accounts on the sandbox environment using your Intigriti alias email (e.g., username+user1@intigriti.me) and dummy data. You can create as many accounts as required for your scenarios.
- MFA Bypass: During the initial setup, use the code 000000 as an MFA bypass.
- KYC Stage: Complete the registration process until you reach the ID verification (KYC) stage.
Crucial Step: Once you have registered your accounts, please answer us back via email or your report with the specific Intigriti alias emails used. Our team will then manually perform a KYC bypass to grant you access.
Happy hacking, and thank you for helping us secure Uphold!
Uphold Security Team
We’ve launched Corporate Self-Signup, allowing researchers to instantly create sandbox environments to explore and test Uphold’s Enterprise APIs, no sales contact or invite required.
Key Details
- Instant Sandbox Access: Create an account and start testing right away.
- Simple 3-Step Flow:
- Fill out a short form
- Confirm your email
- Set up 2FA and begin testing
Important : Please conduct all testing exclusively in sandbox environments created through the self-signup process. Testing in production will affect the analysis and validity of reports, and may lead to disqualification.
You can access the new signup flow and start testing here: Signup
Hey there, fellow hackers!
We’ve made several updates to the program scope, rules, and details to make it easier for you to navigate, understand, and contribute to our bug bounty program. These improvements include:
✅ Clearer Scope & Testing Guidelines – Helping you focus on what matters most and have proper context about each application's capabilities.
✅ Refined Rules of Engagement – Ensuring transparency in how we operate.
✅ Improved Severity Assessment & Rewards – Better alignment with impact.
✅ Expanded FAQ – Answering common questions to save you time.
✅ New Known Issues Section – Avoid submitting duplicates by checking reported issues first.
🚀 Check out the updated program details here: Uphold BB Program
🔑 Need Credentials for Sandbox Testing?
We provide limited sets of sandbox credentials to help researchers expand their testing surface. Access will be granted on a rotating basis and prioritized based on ongoing research needs. If you require credentials, please contact us, and we will do our best to accommodate your request while ensuring fair access to all researchers.
💡 Your feedback matters! If you have suggestions or thoughts on these changes, feel free to share them.
Happy hacking, and thank you for helping us secure Uphold!
Uphold Security Team
Hey there, fellow hackers!
October is Cyber Security Month, and we want to celebrate with you. From October 21st 2024 to October 31st 2024, we're spicing up our bug bounty program with some awesome perks. It's our way of saying thanks for helping us keep things secure.
What's Up for Grabs?
- €1,000 Extra Cash: Found a valid bug that's medium severity or higher? Boom - there's an extra €1000 in it for you, on top of our regular bounty.
- Sweet Swag: Who doesn't love free gear? Score some exclusive Uphold merchandise to show off your elite hacker status.
Why You Should Jump In
We know you're all about making the digital world safer, and so are we. This is your chance to showcase your skills, earn some cash, and grab some cool stuff along the way.
How to Get Started
- Hunt for Bugs: Dive into our platform and see what you can uncover.
- Report It: Found something? Let us know through Intigrit's official bug bounty submission process.
- Claim Your Rewards: If it's a valid medium (or higher) severity bug, the bonus and swag are all yours!
Need-to-Know Details
- The promotion runs from October 21st 2024 to October 31st 2024.
- Only findings classified as medium severity or above qualify for the bonus and goodies.
- All findings must follow our bug bounty program policies.
So, are you ready to join the hunt and make a difference? Let's team up to make Uphold safer for everyone.
Got questions or just want to chat? Hit us up at security@uphold.com. We're all ears!
Happy hacking, and good luck!
Hunters!
It’s been a while, and we’ve been hard at work building more things for you to break. We’ve recently released Uphold Vault (part of the Uphold Wallet application) and UpHODL, two flagship products that we’re very proud of.
We would love to see all of the improvements that we can make to these products, so for every vulnerability found (and validated by both the Intigriti team and by us) for these two products before 31/06/2024, we’ll give you a 30% bonus!
In this update we’ve also expanded our scope to include new applications (including Topper), added a bonus scheme for exceptional vulnerabilities that would have a significant business impact, and upped our bounties. Please check it all out and see what you can find.
As always, happy hunting!
The Uphold Team
Dear Intigriti Hunters,
We've made massive changes to our program, with a re-focus on bugbounty for 2022.
We'd love you to take a new look at the scope, as we've introduced new tier levels and new scopes.
And bigger bounties
We look forward to seeing you, happy hunting!
The Uphold Team