# Coinbase: bug bounty program on Cantina

> Coinbase is a bug bounty program on Cantina. 21 assets are listed in scope, 21 of them bounty-eligible.

- **Company:** Coinbase
- **Platform:** Cantina
- **Program page:** https://cantina.xyz/bounties/55316f42-3c5e-4746-9bd0-0f18dcbc344b
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** July 8, 2025
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/coinbase-2

## Scope

As imported from Cantina on October 24, 2026: 21 assets in scope (21 bounty-eligible), 0 out of scope. The policy page is the authority.

- `Base AppChains` (OTHER): in scope, bounty-eligible, max severity critical
- `Base Fault Proofs` (OTHER): in scope, bounty-eligible, max severity critical
- `Basenames` (OTHER): in scope, bounty-eligible, max severity critical
- `Coinbase Attestations` (OTHER): in scope, bounty-eligible, max severity critical
- `Coinbase Smart Wallet infrastructure` (OTHER): in scope, bounty-eligible, max severity critical
- `Coinbase's validator staking infrastructure` (OTHER): in scope, bounty-eligible, max severity critical
- `Commerce Payments` (OTHER): in scope, bounty-eligible, max severity critical
- `DEX Aggregator` (OTHER): in scope, bounty-eligible, max severity critical
- `EIP-7702` (OTHER): in scope, bounty-eligible, max severity critical
- `https://docs.base.org/base-chain/network-information/base-contracts` (URL): in scope, bounty-eligible, max severity critical
- `https://www.coinbase.com/blog/coinbase-wrapped-btc-cbbtc-is-now-live` (URL): in scope, bounty-eligible, max severity critical
- `https://www.coinbase.com/price/coinbase-wrapped-staked-eth` (URL): in scope, bounty-eligible, max severity critical
- `Onchain Pass` (OTHER): in scope, bounty-eligible, max severity critical
- `Others` (OTHER): in scope, bounty-eligible, max severity critical
- `Spend Permissions` (OTHER): in scope, bounty-eligible, max severity critical
- `Verified Pools` (OTHER): in scope, bounty-eligible, max severity critical
- `Wrapped Token (ADA)` (OTHER): in scope, bounty-eligible, max severity critical
- `Wrapped Token (DOGE)` (OTHER): in scope, bounty-eligible, max severity critical
- `Wrapped Token (LTC)` (OTHER): in scope, bounty-eligible, max severity critical
- `Wrapped Token (XRP)` (OTHER): in scope, bounty-eligible, max severity critical
- `Wrapped Tokens` (OTHER): in scope, bounty-eligible, max severity critical

---

Generated October 24, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.