# Celestia: bug bounty program on HackenProof

> Celestia is a bug bounty program on HackenProof. 10 assets are listed in scope, 10 of them bounty-eligible.

- **Company:** Celestia
- **Platform:** HackenProof
- **Program page:** https://hackenproof.com/programs/celestia
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** March 26, 2025
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/celestia

## Scope

As imported from HackenProof on October 21, 2026: 10 assets in scope (10 bounty-eligible), 0 out of scope. The policy page is the authority.

- `https://github.com/celestiaorg/celestia-app` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/celestia-core` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/celestia-node` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/go-fraud` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/go-header` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/go-square` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/nmt` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/celestiaorg/rsmt2d` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/klauspost/reedsolomon` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/succinctlabs/sp1-blobstream` (SOURCE_CODE): in scope, bounty-eligible, max severity critical

---

Generated October 24, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.